Someone on Torrent Sites Kept Fucking with My Sonarr

Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.

Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.

Joining private trackers is hard only if you are trying to join the niche ones which is totally unnecessary if you are trying to watch relatively recent and popular movies.

Just get into a decent general tracker and you'll literally never have this issue again (along with getting torrents with more seeders and better tagged content so your "4k" download will never be 480p again)

Ran into the same issue, I created a small program that scans qbittorrent with their API and removes torrents that contain these file extensions and aren't downloading https://git.sbstp.ca/sbstp/qbittorrent-sentinel

If you are too lazy to join private trackers, at least use TraSH guides to set up quality profiles

https://trash-guides.info/

> It even grabs your Sticky Notes for WHAT????

The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way

The new sonar version v4 has made it even more easy to get around this. But yeah. You can configure sonar better

Feels kind of weird that Windows Defender doesn't have something that catches this kind of behaviour? I mean if you have the Defender settings jacked up you're not going to be able to run executables anyway without a bunch of mucking around which should at least stop accidental running, but feels like some heuristics to stop these kinds of stealers should be a high priority for the Defender team. Not sure how you'd go about it though?

Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.

You don’t block it in qbittorrent, you let it download and then get sonarr to block the torrent when it detects an exe.

And also, stop posting claudeslop. We know it’s claudeslop. You tried really hard to modify it and conceal it, but you can’t fool a sloprunner. So please, just write your own fucking article. It’s like 4 paragraphs long.

Sonarr could have ignored those EXE filetypes, no?

> XOR a global. XOR it back. Do nothing. Hundreds of times. It exists purely to make the decompiler output look like shit, and it does, congrats.

No, that's to exhaust sandboxing without being able to trust sleep() or time API calls by the only way you can: generating heat.

Skill issue. Configure your Sonarr better.

The same happens for other series as well! I was frustrated with it! Good thing you decompiled this monstrosity

Ince I discovered usenet I rarely want to deal with torrents

Haven't seen this on usenet so far. Wonder if its more torrent prone.

Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.

Scammers always have a new trick up their sleeve.

An excellent read. Thank you. I enjoyed it!

I got sick of this shit a few weeks ago, so now as soon as the torrent client starts downloading an executable it removes the torrent. Definitely seems to be an increase recently.

This has been a thing since torrents have existed.

Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.

> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????

The ability to change it, dude. Have you never written a malware before?

Often a primary concern is the security response, so you want redundancy for the ability to work around enforcement action, such as website takedowns.

Hardcoding a scapegoat into the malware itself also buys you time, so that the first enforcement action is less likely to spend your backups right away.

> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.

People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.

Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...

[dead]

Is this a joke? Who’s upvoting this? It should be titled “I didn’t even bother asking an LLM to configure my server”

How is the *arr stack so fracking complicated? Once upon a time, all you needed was a browser, a torrent client, and VLC. Maybe your torrent client had an RSS feed built in.

Now you need 9 different pieces of software that end in *arr, all of which implement parts of the solution that you want and parts that you don't, and none of them is even a torrent client!

And they don't even work with torrent sites reliably, so people then spend money on a Usenet subscription like it's 1990 again.