RecordAnyVid & VideoSolo- possible malware?
September 26, 2022 5:13 PM Subscribe
Someone I work with tried to download RecordAnyVid but instead ended up downloading a totally different program. What happened, and should they be worried?
This person had purchased a Windows license for RecordAnyVid through VidPaw on my recommendation. They went to the VidPaw store to try to download it. They clicked the blue and yellow camera icon over RecordAnyVid in the Most Popular Picks section. Mousing over this icon indicates the URL is https://www.vidpaw.com/recordanyvid. However, when they clicked on the link, they were instead redirected to the URL https://www.videosolo.com/screen-recorder/. The person then downloaded and ran the executable, but obviously was not able to activate the license with their RecordAnyVid credentials.
I tried this myself and confirmed that the incorrect redirect is still happening. I also noticed it happens if you click the ConvertAnyVid icon as well.
I've been using the Mac version of RecordAnyVid for over a year and haven't had an issue. However, I'm now fairly creeped out, and the creepy "Record your life, remain alive" tagline for RecordAnyVid on the erroneously-redirecting VidPaw site doesn't help.
My questions are:
1) How did this happen in the first place?
2) Does it indicate something malicious is happening?
3) Does the person who downloaded VideoSolo need to take any additional steps beyond uninstalling the program and running a virus scan?
4) Should this decrease my trust in RecordAnyVid?
This person had purchased a Windows license for RecordAnyVid through VidPaw on my recommendation. They went to the VidPaw store to try to download it. They clicked the blue and yellow camera icon over RecordAnyVid in the Most Popular Picks section. Mousing over this icon indicates the URL is https://www.vidpaw.com/recordanyvid. However, when they clicked on the link, they were instead redirected to the URL https://www.videosolo.com/screen-recorder/. The person then downloaded and ran the executable, but obviously was not able to activate the license with their RecordAnyVid credentials.
I tried this myself and confirmed that the incorrect redirect is still happening. I also noticed it happens if you click the ConvertAnyVid icon as well.
I've been using the Mac version of RecordAnyVid for over a year and haven't had an issue. However, I'm now fairly creeped out, and the creepy "Record your life, remain alive" tagline for RecordAnyVid on the erroneously-redirecting VidPaw site doesn't help.
My questions are:
1) How did this happen in the first place?
2) Does it indicate something malicious is happening?
3) Does the person who downloaded VideoSolo need to take any additional steps beyond uninstalling the program and running a virus scan?
4) Should this decrease my trust in RecordAnyVid?
Another of the products on the VidPaw site redirects to videosolo.com (VSC for ease in my post). There are a few possibilities, in escalating order of worrisomeness:
- VidPaw is transitioning to the VSC domain.
- VidPaw is reselling licenses to VSC software.
- VidPaw was purchased by whoever runs VSC.
- VidPaw and/or their website was hacked by whoever runs VSC and the links were updated to direct to the other site.
VidPaw's site, to me, seems kind of clickbaity and built for SEO (while also not being terribly attractive). It would not surprise me to learn they're either responsible for both sites. It seems unlikely their site was hacked, but it is weird that only the icon and title links to VSC; the Buy Now buttons launch a purchase process on VidPaw (though obviously I did not complete the purchase, so maybe it ends up on VSC at some point). For what it's worth, the site sends an HTTP 301 "Moved Permanently" header when clicking on the link, which is a signal to the browser and search engines that the VSC site is replacing the vidpaw.com/recordanyvid site.
If you search for "vidpaw" on the VSC domain exclusively, there are references to it in (again, clickbaity) "tutorials" that review software, and they're reviewing VidPaw (only 4/5 stars!). I have no idea what this actually means.
Make sure you run a virus and malware scan, as software downloaded from unknown sources (even VidPaw) can be infected or intended to infect a computer. Outside of that I'm not sure we'll ever know without doing a deep dive on domain registration (if it's not private) and business records etc.
posted by tubedogg at 7:45 PM on September 26, 2022
- VidPaw is transitioning to the VSC domain.
- VidPaw is reselling licenses to VSC software.
- VidPaw was purchased by whoever runs VSC.
- VidPaw and/or their website was hacked by whoever runs VSC and the links were updated to direct to the other site.
VidPaw's site, to me, seems kind of clickbaity and built for SEO (while also not being terribly attractive). It would not surprise me to learn they're either responsible for both sites. It seems unlikely their site was hacked, but it is weird that only the icon and title links to VSC; the Buy Now buttons launch a purchase process on VidPaw (though obviously I did not complete the purchase, so maybe it ends up on VSC at some point). For what it's worth, the site sends an HTTP 301 "Moved Permanently" header when clicking on the link, which is a signal to the browser and search engines that the VSC site is replacing the vidpaw.com/recordanyvid site.
If you search for "vidpaw" on the VSC domain exclusively, there are references to it in (again, clickbaity) "tutorials" that review software, and they're reviewing VidPaw (only 4/5 stars!). I have no idea what this actually means.
Make sure you run a virus and malware scan, as software downloaded from unknown sources (even VidPaw) can be infected or intended to infect a computer. Outside of that I'm not sure we'll ever know without doing a deep dive on domain registration (if it's not private) and business records etc.
posted by tubedogg at 7:45 PM on September 26, 2022
If you go to the Vidpaw's english homepage, https://www.vidpaw.com/en/
Mouse over RecordAnyVid, and you'll get a Download Link that does NOT get forwarded to VideoSolo. It downloads an exe called RecordAnyVid.exe. However, if you click on "learn More", you get forwarded to the VideoSolo webpage.
posted by kschang at 9:13 PM on September 26, 2022
Mouse over RecordAnyVid, and you'll get a Download Link that does NOT get forwarded to VideoSolo. It downloads an exe called RecordAnyVid.exe. However, if you click on "learn More", you get forwarded to the VideoSolo webpage.
posted by kschang at 9:13 PM on September 26, 2022
This thread is closed to new comments.
posted by quiet coyote at 5:39 PM on September 26, 2022