1

I wanted to convert a youtube video to mp3, but the website gaved me an EXE?

http://convertonmp3.com/download/412414/The_Supermen_Lovers_feat_Mani_Hoffman_Starlight_Official_Video.mp3?h=hx7ZBZi7rHuU69RJhqwVuA&e=1422700955

https://www.virustotal.com/en/file/30875cf1a3fc1f699ad74aa47cb01fcfde70d7924d97cf54c2a247d23d627bb5/analysis/1422697618/

UPDATE: I don't think my notebook is infected, I tried with another PC, OS: Linux, and if I use the useragent:

Mozilla/5.0 (Windows NT 6.4; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0

Then there will be ..mp3.exe files!

My original OS was OpenBSD, just with a modificated useragent in Firefox.

closed as off-topic by Xander, schroeder, Scott Pack, Bob Brown, TildalWave Feb 1 '15 at 17:14

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, schroeder, Scott Pack, Bob Brown, TildalWave
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I got an MP3 and a bunch of blocked ads from your link. Probably an infected ad server. – Mark Jan 31 '15 at 10:21
  • Do not install it. The program will riddle your browser with adware add-ons – Tim Jonas Jan 31 '15 at 11:50
3

No, the site convertonmp3.com is not hacked. It is distributing malware by design. That is the business model of this and many other similar sites.

At the above link, you get a “Download with ConvertOnMP3.com Download Manager” checkbox which is ticked by default. (This did not appear for me until I browsed with a Windows web browser; YMMV.) If you click the download link without unticking the box then instead of the .mp3 you get a .exe file. That is the file virustotal is complaining about (note the filename is listed as “The_Supermen_Lovers_feat_Mani_Hoffman_Starlight_Official_Video.mp3​.exe”.

The executable is a downloader from the pay-per-install programme at installpath.com (related domains: keenondownload.com, leadingdownload.com), which will then install a selection of adware depending on whoever is paying them at the time.

  • 1
    Nice I don't why I didn't pick up on something that basic. I must have unticked the boxed subconsciously. +1 Good job – Tim Jonas Jan 31 '15 at 11:52
0

No problems for me I got an mp3 with 0 detections. I am using google chrome if you are using a google chrome then I would check your browser extensions. https://www.virustotal.com/en/file/7fa3884447060bf7243c40041e44f7e77337d91ff65b2ae55eaad52367d64a4a/analysis/1422699775/ VirusTotal

Not the answer you're looking for? Browse other questions tagged or ask your own question.