Sogou.com downloads - spyware/viruses?

[Epickyle]

Hey guys,

I know there's a few computer pros on the forum so was just wondering: Is there any harm from downloading music files from sogou.com? I downloaded a few and had no problems listening to them but then my brother (it's his computer) started freaking out about viruses and whatnot because it's a Chinese site.

I tried to run one of the .mp3s with VLC player and it wouldn't start so deleted it straight away. Did a quick search on the net for sogou viruses and apparently there is one but not sure if they're related. Any advice?

[feihong]

There aren't any rogue MP3 files out there. It's just a media format.

[Matty]

In my experience (and this is my field) I've never seen or heard of a virus in an MP3.

I download many things from the internet and download almost all my MP3's from

http://mp3.sogou.com and

http://mp3.baidu.com

without any problems. As long as it's a .mp3 and downloaded from those two sites

you're pretty safe.

If you're really worried though you could try the google version:

http://www.google.cn/music/homepage

Even google joins the Chinese mp3 party - must have some hell of a licensing setup going there

[jbradfor]

There aren't any rogue MP3 files out there. It's just a media format.

I'd agree 99%. mp3 are a data file, not an executable, so they can not be a virus.

The last 1% is because it is possible that a mp3 could be crafted to take advantage of a bug in an mp3 player (or lack of error checking) and transmit that way. However, it would be specific to a particular mp3 player, version, and OS. I wouldn't worry about it, though.

[Epickyle]

Thanks for the advice guys. The file I downloaded was in the Sogou top 100 songs, (think it was 没那么容易 or 无法原谅) so I assumed it was safe. It had a bit of a random filename. I tried to drag and drop it into my ipod using itunes and it said it was not a valid mp3 file so I got a bit concerned, then I tried to open it with VLC media player using the context menu and it wouldn't run there either. Generally I get suspicious when files don't do what they're supposed to, especially with VLC, which runs everything. which is why I asked. The icon looked like an .mp3 extension I think but can't be 100% sure if it was a bona fide .mp3 right? (It was late!)

Anyway google chrome said that the preferences file was corrupted when I restarted after that so it seemed like too much of a conincidence. My main concern is that since sogou redirects you to a different download site to get the song I could have been sent to a suspect one.

So, since I only tried to run it with mp3 software and not double click it, if it were a virus or something would I be ok? Has anyone else ever downloaded an mp3 from Sogou that didn't work?

[yonglin]

Has anyone else ever downloaded an mp3 from Sogou that didn't work?

Many times. What was the actual file size? Most of the .mp3 downloads that end up not working for me tend to be something on the order of 10kb rather than 4mb after I downloaded them, i.e., it's obviously not the right file. I always assumed the file or download reference was just corrupted/incorrect.

[Matty]

It's most probably just a bad link that download a .html file saying 404 error not found and saving it as a .mp3 extension.

The weird file names are normal and mostly caused by various CMS softwares renaming them for it's own security and convenience.

I've personally never actually had one not play from sogou.

Where you really need to worry is if it has the shortcut arrow in the bottom left of the mp3 icon. As the shortcut extention '.lnk' is always hidden, a shortcut named 'bestsong.mp3.lnk' will only show as 'bestsong.mp3' and can hold some pretty nasty code inside. So watch out for the shortcut arrow.

For the most part running through sogou you should be pretty safe. With some consideration I can see how it could be exploited, but I don't think I'd worry about it.

If you're really concerned however, follow tese instructions when looking for music:

1) Open this site http://box.zhangmen.baidu.com

2) Search via the search box at the top or via the lists in the left.

3) Play the song you would like to download

4a) If you can hear the song playing, it is your best bet of safety and can download from the link at the top of the page

4b) If you don't hear the song playing, try another copy of it

This way you're testing that it's a valid and working MP3 through the flash player before downloading the same mp3 file.

In theory you can do the same with sogou, however I can't confirm the download link is the same as the mp3 being played.

Disclaimer: Only use this for public domain and other legal musics that you hold rights to download.

[Epickyle]

Thanks for your help guys,

Have used the computer a couple of times since then and seems to be ok but thanks for your help and advice! Will be more careful in future!