Home Malware Programs Adware Ads by VidSqaure

Ads by VidSqaure

Posted: August 30, 2016

Threat Metric

Ranking: 13,524
Threat Level: 2/10
Infected PCs: 6,396
First Seen: August 31, 2016
Last Seen: October 13, 2023
OS(es) Affected: Windows

VidSqaure is a DNS service linked to Ghostify, another DNS service provider that may expose its users to online ads and other marketing content while they browse the Web via the Ghostify's DNS settings. VidSqaure works in a similar way, and users who wish to take advantage of its services may end up finding their Web browser cluttered with pop-ups and online advertisements that may often promote Potentially Unwanted Programs (PUPs), affiliate links and other irrelevant content.

VidSqaure is advertised as a DNS service that allows its users to browse websites that they wouldn't be able to visit otherwise due to limitations set by their employer, school, government or Internet Service Provider (ISP). VidSqaure's website even lists services that their users might be able to access via the modified DNS settings – Hulu, HBO, Netflix, Spotify, etc. There is no doubt that using VidSqaure's does indeed bypass any filters that may prevent the user from accessing these services in case they are blocked. However, while VidSqaure's settings are active, users may see ads and other sponsored content in their Web browser, therefore diminishing their Web browsing experience.

Using VidSqaure's services does not put the user's online safety in danger. However, because it injects a large number of 'Ads by VidSqaure' in the computer user's Web browser, many users might not enjoy being exposed to unwanted ads while browsing their favorite websites. There are better alternatives to VidSqaure, and many of them would never use ads to monetize their service. This is whyyou should seek a better alternative to VidSqaure if you want to unblock particular websites.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



setup.exe File name: setup.exe
Size: 1.92 MB (1920525 bytes)
MD5: 51c80a9895a5f6236413e2d888be47be
Detection count: 52
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: January 12, 2017

Registry Modifications

The following newly produced Registry Values are:

File name without pathwww.vidsqaure[1].xmlRegexp file mask%WINDIR%\System32\Tasks\Gs1EndPimAeN%WINDIR%\System32\Tasks\GTFAVENUE%WINDIR%\System32\Tasks\IzO1FHinrqLy%WINDIR%\System32\Tasks\rZjnDSqKH4pyHKEY..\..\..\..{RegistryKeys}SOFTWARE\GTFAVENUE UpdaterSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Gs1EndPimAeNSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\rZjnDSqKH4pySOFTWARE\Wow6432Node\Gs1EndPimAeN UpdaterSOFTWARE\Wow6432Node\GTFAVENUE UpdaterSOFTWARE\Wow6432Node\IzO1FHinrqLy UpdaterSOFTWARE\Wow6432Node\rZjnDSqKH4py UpdaterSOFTWARE\Wow6432Node\yufxTCH1hFwV UpdaterSYSTEM\ControlSet001\services\GTFAVENUE UpdaterSYSTEM\ControlSet002\services\GTFAVENUE UpdaterSYSTEM\CurrentControlSet\services\GTFAVENUE UpdaterHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Gs1EndPimAeN Updater_is1GTFAVENUE Updater_is1rZjnDSqKH4py Updater_is1{A97606DF-0FE1-4390-B0DD-ADA8B303AE61}_is1

Additional Information

The following directories were created:
%PROGRAMFILES%\3GxDLmlwpCcB%PROGRAMFILES%\3GxDLmlwpCcB Updater%PROGRAMFILES%\3qGThdMvVeaA%PROGRAMFILES%\5XmGEAhtrlIw%PROGRAMFILES%\5XmGEAhtrlIw Updater%PROGRAMFILES%\5tCmcTEaLRlq%PROGRAMFILES%\7JcwvpoNWCKh%PROGRAMFILES%\7JcwvpoNWCKh Updater%PROGRAMFILES%\8noDvmWaQgXZ%PROGRAMFILES%\AeFjsLPt2bzM%PROGRAMFILES%\AeFjsLPt2bzM Updater%PROGRAMFILES%\AqbTlDEHz2pn%PROGRAMFILES%\AqbTlDEHz2pn Updater%PROGRAMFILES%\BGgEaHsqVh5f Updater%PROGRAMFILES%\GTFAVENUE%PROGRAMFILES%\GTFAVENUE Updater%PROGRAMFILES%\IzO1FHinrqLy%PROGRAMFILES(x86)%\3GxDLmlwpCcB%PROGRAMFILES(x86)%\3GxDLmlwpCcB Updater%PROGRAMFILES(x86)%\3qGThdMvVeaA%PROGRAMFILES(x86)%\5XmGEAhtrlIw%PROGRAMFILES(x86)%\5XmGEAhtrlIw Updater%PROGRAMFILES(x86)%\5tCmcTEaLRlq%PROGRAMFILES(x86)%\7JcwvpoNWCKh%PROGRAMFILES(x86)%\7JcwvpoNWCKh Updater%PROGRAMFILES(x86)%\8noDvmWaQgXZ%PROGRAMFILES(x86)%\AeFjsLPt2bzM%PROGRAMFILES(x86)%\AeFjsLPt2bzM Updater%PROGRAMFILES(x86)%\AqbTlDEHz2pn%PROGRAMFILES(x86)%\AqbTlDEHz2pn Updater%PROGRAMFILES(x86)%\BGgEaHsqVh5f Updater%PROGRAMFILES(x86)%\GTFAVENUE%PROGRAMFILES(x86)%\GTFAVENUE Updater%PROGRAMFILES(x86)%\Gs1EndPimAeN Updater%PROGRAMFILES(x86)%\LJaSrvQtsZ8c Updater%PROGRAMFILES(x86)%\rZjnDSqKH4py Updater
Loading...