Someone on Torrent Sites Kept Fucking with My Sonarr

(thereallo.dev)

72 points | by speckx 1 hour ago

16 comments

  • bhaney 53 minutes ago
    Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.

    Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.

  • shmoil 1 hour ago
    If you are too lazy to join private trackers, at least use TraSH guides to set up quality profiles

    https://trash-guides.info/

    • gradstudent 46 minutes ago
      Join how, exactly, and for what benefit? The private trackers I've heard of are not open or you have to pay to join (lol!). From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene. I bet theres a leaderboard somewhere with weektop and sitetop numbers. I'm too old for that shit.
      • lelandfe 29 minutes ago
        > The private trackers I've heard of are not open… From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene

        TBF this isn’t a revival of some 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.

      • torben-friis 37 minutes ago
        You can get into some not paying. You're just required to either have a minimum ratio or share several days, whatever's reached sooner (so you don't get stuck sharing something nobody wants for eternity).

        In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.

      • SSLy 30 minutes ago
        I'm on them for over 10 years. Last time I've cared about ratio was 9.
      • aaron695 2 minutes ago
        [dead]
  • Havoc 1 hour ago
    > It even grabs your Sticky Notes for WHAT????

    The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way

  • josu 12 minutes ago
    Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.
  • riley_dog 52 minutes ago
  • egberts1 10 minutes ago
    Sonarr could have ignored those EXE filetypes, no?
  • dd_xplore 1 hour ago
    The same happens for other series as well! I was frustrated with it! Good thing you decompiled this monstrosity
  • para_parolu 51 minutes ago
    Ince I discovered usenet I rarely want to deal with torrents
    • stronglikedan 41 minutes ago
      As someone who still pays for usenet, the benefit of torrents is anything older than a couple of days, since stuff gets pulled from usenet servers almost as soon as it's posted. Of course, if you have everything pre-configured to find and grab everything you're interested in, you won't even notice, but sometimes I just get an itch to watch something older off the cuff, and that's where torrents shine.
  • bastard_op 18 minutes ago
    Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.

    Scammers always have a new trick up their sleeve.

  • hoppp 46 minutes ago
    An excellent read. Thank you. I enjoyed it!
  • joloooo 1 hour ago
    Haven't seen this on usenet so far. Wonder if its more torrent prone.
    • redrove 1 hour ago
      Got this in my sabnzbd instance and had to do .exe rules there too. An exe in a linux container…very smart.

      I’m as upset as OP, get a job skid.

    • bhaney 49 minutes ago
      It's by far the most common on public torrent trackers, but I occasionally see it on usenet too. Never bothered to check which indexers they tend to come from.
  • comrade1234 1 hour ago
    Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.
    • c-hendricks 19 minutes ago
      Plenty of my iso's intentionally contain those names though. Really, sonarr / radarr should have implemented this a long time ago since they're the ones doing the searching, downloading, and inspecting of files: https://github.com/Sonarr/Sonarr/pull/8775

      Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.

      Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.

      Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.

    • yborg 57 minutes ago
      Yeah, this whole post felt like some weird deja vu from 25 years ago on a web forum. "Bastards are putting malware exe's on file sharing, wtf??"
    • queenkjuul 53 minutes ago
      Join a private tracker and never think about it again
      • serf 44 minutes ago
        yeah!

        let's all join a private tracker!

        that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.

        /s

        how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?

  • hparadiz 1 hour ago
    This has been a thing since torrents have existed.
  • LoganDark 19 minutes ago
    > But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????

    The ability to change it, dude. Have you never written a malware before?

    Often a primary concern is the security response, so you want redundancy and the ability to work around enforcement action, such as website takedowns.

    > And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.

    People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.