Scott Duncan
Click on the link and you see an MP3 file that can be played in your browser.
He did not send that, he sent an EXECUTABLE file which will run in the security context of YOU. Like every idiot on the internet using windows, you will have ADMINISTRATIVE access, instead of using a locked-down USER account, so it runs AS AN ADMINISTRATOR and nothing will stop it.
As i said: THERE IS NO LEGITIMATE REASON TO SEND AN EXECUTABLE FILE.