YHK - yet another hacker news clone

Someone on Torrent Sites Kept Fucking with My Sonarr

65 points speckx 1 hour ago 24 comments

comrade1234 1 hour ago | parent

Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.

yborg 48 minutes ago | parent

Yeah, this whole post felt like some weird deja vu from 25 years ago on a web forum. "Bastards are putting malware exe's on file sharing, wtf??"

queenkjuul 44 minutes ago | parent

Join a private tracker and never think about it again

serf 35 minutes ago | parent

yeah!

let's all join a private tracker!

that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.

/s

how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?

c-hendricks 11 minutes ago | parent

Plenty of my iso's intentionally contain those names though. Really, sonarr / radarr should have implemented this a long time ago since they're the ones doing the searching, downloading, and inspecting of files: https://github.com/Sonarr/Sonarr/pull/8775

Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.

Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.

Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.

shmoil 1 hour ago | parent

If you are too lazy to join private trackers, at least use TraSH guides to set up quality profiles

https://trash-guides.info/

gradstudent 38 minutes ago | parent

Join how, exactly, and for what benefit? The private trackers I've heard of are not open or you have to pay to join (lol!). From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene. I bet theres a leaderboard somewhere with weektop and sitetop numbers. I'm too old for that shit.

torben-friis 28 minutes ago | parent

You can get into some not paying. You're just required to either have a minimum ratio or share several days, whatever's reached sooner (so you don't get stuck sharing something nobody wants for eternity).

In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.

SSLy 21 minutes ago | parent

I'm on them for over 10 years. Last time I've cared about ratio was 9.

lelandfe 21 minutes ago | parent

> The private trackers I've heard of are not open… From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene

TBF this isn’t a revival of some 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.

joloooo 1 hour ago | parent

Haven't seen this on usenet so far. Wonder if its more torrent prone.

redrove 57 minutes ago | parent

Got this in my sabnzbd instance and had to do .exe rules there too. An exe in a linux container…very smart.

I’m as upset as OP, get a job skid.

bhaney 41 minutes ago | parent

It's by far the most common on public torrent trackers, but I occasionally see it on usenet too. Never bothered to check which indexers they tend to come from.

Havoc 1 hour ago | parent

> It even grabs your Sticky Notes for WHAT????

The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way

dd_xplore 59 minutes ago | parent

The same happens for other series as well! I was frustrated with it! Good thing you decompiled this monstrosity

hparadiz 52 minutes ago | parent

This has been a thing since torrents have existed.

bhaney 44 minutes ago | parent

Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.

Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.

para_parolu 43 minutes ago | parent

Ince I discovered usenet I rarely want to deal with torrents

stronglikedan 32 minutes ago | parent

As someone who still pays for usenet, the benefit of torrents is anything older than a couple of days, since stuff gets pulled from usenet servers almost as soon as it's posted. Of course, if you have everything pre-configured to find and grab everything you're interested in, you won't even notice, but sometimes I just get an itch to watch something older off the cuff, and that's where torrents shine.

hoppp 37 minutes ago | parent

An excellent read. Thank you. I enjoyed it!

LoganDark 10 minutes ago | parent

> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????

The ability to change it, dude. Have you never written a malware before?

Often a primary concern is the security response, so you want redundancy and the ability to work around enforcement action, such as website takedowns.

> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.

People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.

bastard_op 9 minutes ago | parent

Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.

Scammers always have a new trick up their sleeve.

josu 3 minutes ago | parent

Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.

egberts1 1 minute ago | parent

[delayed]