Can you look into this unblocking proxy tool that can be run from a USB flash drive. It appears to use port 9666. I have added an outbound rule for that but it still allows viewing of otherwise unblocked sites. The students are passing this around.
We currently have signatures for the chrome extension, however the Windows version is a little more complicated.
You can apply the ultrasurf signature if you don’t already have proxies and vpns blocked. Unfortunately this won’t necessarily catch it completely. Ultrasurf is notorious for using any means possible to get out. I believe it can even mask itself as DNS traffic and tunnel out that way.
We’re always working to improve these signatures etc however nothing will ever be 100% effective.
I don’t think the signature for the Chrome extension is working presently.
I’m happy to give you a hand testing this is you want.