I wanted to convert a youtube video to mp3, but the website gaved me an EXE?



UPDATE: I don't think my notebook is infected, I tried with another PC, OS: Linux, and if I use the useragent:

Mozilla/5.0 (Windows NT 6.4; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0

Then there will be ..mp3.exe files!

My original OS was OpenBSD, just with a modificated useragent in Firefox.

  • I got an MP3 and a bunch of blocked ads from your link. Probably an infected ad server.
    – Mark
    Commented Jan 31, 2015 at 10:21
  • Do not install it. The program will riddle your browser with adware add-ons
    – Tim Jonas
    Commented Jan 31, 2015 at 11:50

2 Answers 2


No, the site convertonmp3.com is not hacked. It is distributing malware by design. That is the business model of this and many other similar sites.

At the above link, you get a “Download with ConvertOnMP3.com Download Manager” checkbox which is ticked by default. (This did not appear for me until I browsed with a Windows web browser; YMMV.) If you click the download link without unticking the box then instead of the .mp3 you get a .exe file. That is the file virustotal is complaining about (note the filename is listed as “The_Supermen_Lovers_feat_Mani_Hoffman_Starlight_Official_Video.mp3​.exe”.

The executable is a downloader from the pay-per-install programme at installpath.com (related domains: keenondownload.com, leadingdownload.com), which will then install a selection of adware depending on whoever is paying them at the time.

  • 1
    Nice I don't why I didn't pick up on something that basic. I must have unticked the boxed subconsciously. +1 Good job
    – Tim Jonas
    Commented Jan 31, 2015 at 11:52

No problems for me I got an mp3 with 0 detections. I am using google chrome if you are using a google chrome then I would check your browser extensions. https://www.virustotal.com/en/file/7fa3884447060bf7243c40041e44f7e77337d91ff65b2ae55eaad52367d64a4a/analysis/1422699775/ VirusTotal

Not the answer you're looking for? Browse other questions tagged .