Is InfraRecorder Safe? Malware, Bundled Software and Hash Checks
Short answer: yes — the official InfraRecorder 0.53 installer, downloaded from SourceForge and checked against the published checksums below, is clean free software. It is an open-source program released under GPL v3, written by Christian Kindahl, and the official installer shows no evidence of bundled adware. The risk people actually run into is not InfraRecorder itself. It is the repackaged copies offered by third-party download sites, which can wrap any well-known free program in their own installer. This page explains what we verified, how we verified it, and how you can check your own download in under a minute.
If you have not downloaded the program yet, use the InfraRecorder download page, which links the official SourceForge files directly. If you already have a copy from somewhere else, the hash check in the middle of this page tells you whether what you have is the genuine 0.53 release from 1 September 2012 — the final version, since the project has had no release since then.
What We Checked in the Official Installer
We downloaded the official installer, ir053.exe, from the SourceForge project files area and inspected it directly. It is a Nullsoft NSIS 2.46 installer for 32-bit Windows, and it carries an Authenticode certificate table — in plain terms, the file is digitally signed, which is not something repackaged or tampered copies usually preserve correctly. The source package even ships the signing script the developer used, which fits the picture of a normal open-source release process.
We also scanned the installer’s binary strings for the usual bundled-software fingerprints. There is no evidence that the official installer ever bundled OpenCandy or any adware: no OpenCandy components, no toolbar offers, no Babylon, Conduit or advertising modules appear in the file, and targeted web searching found no credible source linking InfraRecorder to OpenCandy at all. That matters because OpenCandy was common in free Windows software of exactly this era — its absence here is a genuine point in InfraRecorder’s favour, not an assumption. One 2015 SourceForge review complains that a browser treated the download process itself with suspicion; that is a remark about download-site warnings, not evidence of anything bundled in the installer.
Verify Your Download: The Official Checksums
The strongest safety check needs no antivirus opinion at all. InfraRecorder 0.53 was published with MD5 checksums on the official site, and those same values appear in SourceForge’s file metadata. We downloaded all six official files and computed their hashes ourselves — our values match both published sources exactly. If your file’s hash matches the table, you have the untouched official file. If it does not, delete it and download again from SourceForge.
| File | MD5 | SHA-256 |
|---|---|---|
ir053.exe | 55b8e85efd9731d7b9d5f5f7e4de5a2d | 8cee83f7f489a6aef4218a953b87b1c22d6a93c966e79275c8cb2abe830d0731 |
ir053_x64.msi | 8865e1ca72d540a07d530b2ccec8fd89 | 332704763605252ef9e88d2a8ce6d076719f0acb307db231069483ae5ca407ff |
ir053_portable.zip | 845fd8866f2d700095cb5ac40c4d9ceb | 845498d8fb766f677807f2b95b03f6d544f8c0faa089651d92e3655c36fa91db |
ir053_portable_x64.zip | 979de325a8798ac24db1bae5ec4d2bd7 | b8819e1727256b5eeada87c88aa5639cb2abcda174d26fcc686f0b2e8ace051c |
ir053_src.zip | 31daa3bd789797ede6097d210c61b1bb | e06fe21f65c094043b1ced6ac1995fce6946416070480318025b5fdc5844962f |
ir053_mp3_plugin.zip | 80ad142b402ae0b78b1dbf013d82d051 | d83f761f3f65ce9e5e0da68cd647fca9a6df8938ac980af40148bd361574c06c |
On Windows, you can check a file without installing anything. Open PowerShell in the folder holding the download and run Get-FileHash .\ir053.exe -Algorithm SHA256, then compare the long hex string with the SHA-256 column above, character for character. For the portable ZIP editions this check is especially valuable, because a ZIP has no installer signature to rely on — the hash is the whole guarantee. Our guide to InfraRecorder Portable repeats the portable hashes in context.
The Real Risk: Third-Party Repackaged Installers
Search for almost any discontinued free program and you will find download portals offering their own “fast installer” or a version number that does not exist. InfraRecorder has no version newer than 0.53 — any site offering 0.54, a “2025 edition” or similar is fabricating it, and a fabricated version from an unknown wrapper is exactly where bundled offers and worse actually live. The same caution applies to copies of 0.53 whose hash does not match the table above: something changed the file, and you have no way to know what.
Two habits keep you safe. First, download from the canonical source — the SourceForge project files area, linked from our download page — rather than from a portal’s own re-hosted copy. Second, run the hash check before you run the installer. It takes less than a minute and it settles the question completely, which no review, badge or “safe download” logo can do.
What Other Users Report
On SourceForge, InfraRecorder is rated 4.7 out of 5 across 101 reviews, with the newest reviews still arriving in 2025 — a long public track record for a program of this age, and not the profile of software the community considers malicious. The criticisms in those reviews are about age, features and modern-Windows behaviour, not about bundled software.
That last point deserves honesty in the other direction too. “Safe” is not the same as “supported”. InfraRecorder was written for Windows 2000, XP, Vista and 7; it is not officially supported on Windows 10 or 11, and SourceForge users in 2025 have reported burns on those systems that complete yet read back blank, plus inconsistent verification. Those are reliability problems, not malware — but they are why our Windows 11 guide recommends verification after every burn, and why the troubleshooting hub exists. Download the genuine file, verify its hash, verify your burns, and InfraRecorder is exactly what its reputation says: a clean, old, still-useful burner.