Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.
Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.
That'll be good for new installs down the line, but I don't think it's something to "wait on" right now. I have around 30 indexers configured in Prowlarr, but going into Sonarr/Radarr and just changing the no-executables setting for each indexer that's actually active only takes a minute or so and never gets reverted.
Joining private trackers is hard only if you are trying to join the niche ones which is totally unnecessary if you are trying to watch relatively recent and popular movies.
Just get into a decent general tracker and you'll literally never have this issue again (along with getting torrents with more seeders and better tagged content so your "4k" download will never be 480p again)
An .exe? Doesn't everybody run their *arr stack on Linux? Well, that's what I do at least. Even so, crap like this has to be easily blockable. And I wouldn't mind if there was a service that handled that for everybody.
I'm not too lazy to join a private tracker, I'm too lazy to maintain the presence necessary to use one. You're really signing up to be a part of a community. Mostly that's enforced through ratios, but those ratios are often set in such a way that you have to be uploading, or you have to be optimising what you choose to share in a way that gets you to those ratios. If the content you want is popular enough you just can't build ratio on it.
I've found the best way to do private trackers is to seed everything you download, all the time. If you seed enough of the long tail of things, ratio becomes easier. This also helps people get into a show that peaked a few years ago (after most of the seeders have moved on), which can be harder on public trackers.
Join how, exactly, and for what benefit? The private trackers I've heard of are not open or you have to pay to join (lol!). From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene. I bet theres a leaderboard somewhere with weektop and sitetop numbers. I'm too old for that shit.
If you are basic, then Torrentleech will cover 99.999% of your needs. It costs a few $ to join (a one time fee, and you get 1 month of free VPN), or just sign up for r/opensignups, and wait until they are open for registrations (typically once per year).
If you are too old for trackers, then just sign up for usenet. You will have to pay for it though.
> The private trackers I've heard of are not open… From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene
TBF this isn’t a revival of some arch 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.
You can get into some not paying. You're just required to either have a minimum ratio or share several days, whatever's reached sooner (so you don't get stuck sharing something nobody wants for eternity).
In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.
This can get stupid sometimes like when they're expecting everybody to keep over 1.0 when there are people with 10.0; but usually when they're doing that it's because it's a scammy tracker (all private trackers that you have to pay to join are scammy no exceptions) and they're trying to extort people who fall below 1.0 to give them money.
But expecting people to upload is part of the deal. That's not about being old, that's about being selfish. Non-scammy private trackers make it very easy, and some just concentrate on gatekeeping and don't worry about ratios at all.
Your basic point is very true, though. The way many private trackers have lasted is to stop letting people in almost entirely. To get into a non-scammy tracker you have to know somebody irl who is on and active, and they still might not be able to get you in. Or they will pretend like they can't - inviters sometimes get punished for the quality of the people they invite, and you think sharing back is something children do.
Ran into the same issue, I created a small program that scans qbittorrent with their API and removes torrents that contain these file extensions and aren't downloading https://git.sbstp.ca/sbstp/qbittorrent-sentinel
Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.
Started running bitmagnet a few weeks ago after getting fed up with BTDigg dying and other DHT crawlers actually complying with DMCA notices for some reason (???). Pretty much everything even slightly popular that I search for has one of these EXEs lying around. Sometimes multiple.
Feels kind of weird that Windows Defender doesn't have something that catches this kind of behaviour? I mean if you have the Defender settings jacked up you're not going to be able to run executables anyway without a bunch of mucking around which should at least stop accidental running, but feels like some heuristics to stop these kinds of stealers should be a high priority for the Defender team. Not sure how you'd go about it though?
It's by far the most common on public torrent trackers, but I occasionally see it on usenet too. Never bothered to check which indexers they tend to come from.
As someone who still pays for usenet, the benefit of torrents is anything older than a couple of days, since stuff gets pulled from usenet servers almost as soon as it's posted. Of course, if you have everything pre-configured to find and grab everything you're interested in, you won't even notice, but sometimes I just get an itch to watch something older off the cuff, and that's where torrents shine.
Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.
You don’t block it in qbittorrent, you let it download and then get sonarr to block the torrent when it detects an exe.
And also, stop posting claudeslop. We know it’s claudeslop. You tried really hard to modify it and conceal it, but you can’t fool a sloprunner. So please, just write your own fucking article. It’s like 4 paragraphs long.
I got sick of this shit a few weeks ago, so now as soon as the torrent client starts downloading an executable it removes the torrent. Definitely seems to be an increase recently.
Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.
Plenty of my iso's intentionally contain those names though. Really, sonarr / radarr should have implemented this a long time ago since they're the ones doing the searching, downloading, and inspecting of files: https://github.com/Sonarr/Sonarr/pull/8775
Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.
Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.
Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.
that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.
/s
how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?
> a burning of the library of alexandria loss-of-history what.cd style event again
I don’t agree with that framing.
All metadata has been preserved and published, and the sucessor sites to what.CD have long outgrown it; and their successors will again. Anything you find missing, you can request and typically it will be filled within less than 24 hours.
I mean i just joined a private tracker and so I don't have to think about it. Several, actually. It's hard for me to imagine someone taking torrenting seriously enough to set up an arr stack and not belong to a private tracker. Beyond malware, there's the rightsholder spies on the public trackers, and I'm not trying to lose my ISP over copyright strikes.
And i also truly cannot understand what your point is. Trackers are not really legal, they come and go. I don't think a few hundred or even a few thousand HN users joining across the ecosystem is going to suddenly cause them all to get raided
> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????
The ability to change it, dude. Have you never written a malware before?
Often a primary concern is the security response, so you want redundancy for the ability to work around enforcement action, such as website takedowns.
Hardcoding a scapegoat into the malware itself also buys you time, so that the first enforcement action is less likely to spend your backups right away.
> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.
People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.
Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...
the interesting element of the article for me wasn't "somebody put malware on a torrent site", it was how the author reverse engineered the .exe to see why the file ended up there
How is the *arr stack so fracking complicated? Once upon a time, all you needed was a browser, a torrent client, and VLC. Maybe your torrent client had an RSS feed built in.
Now you need 9 different pieces of software that end in *arr, all of which implement parts of the solution that you want and parts that you don't, and none of them is even a torrent client!
And they don't even work with torrent sites reliably, so people then spend money on a Usenet subscription like it's 1990 again.
Any all-in-one solution is going to be considered illegal at face value if it is obviously designed to circumvent copyright.
But if you split all the pieces of the solution up into separate pieces of software that can't do much illegal by themselves, you can always claim plausible deniability as the maintainer.
After all, you aren't going to be downloading torrents with Sonarr, you aren't going to be looking up information about shows with Jackett, and you aren't going to be automating your downloads with qBittorrent. If you link them all together with APIs, though, they do everything automatically.
As for the issue demonstrated here, it's just a long-standing problem in Sonarr and Radarr that even when it detects that a torrent is bad, it just sits there holding onto a virus until you override it with a working torrent, instead of just dumping the bad data and trying again.
Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.
Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.
Still waiting on this https://github.com/Prowlarr/Prowlarr/issues/2329
That'll be good for new installs down the line, but I don't think it's something to "wait on" right now. I have around 30 indexers configured in Prowlarr, but going into Sonarr/Radarr and just changing the no-executables setting for each indexer that's actually active only takes a minute or so and never gets reverted.
Joining private trackers is hard only if you are trying to join the niche ones which is totally unnecessary if you are trying to watch relatively recent and popular movies.
Just get into a decent general tracker and you'll literally never have this issue again (along with getting torrents with more seeders and better tagged content so your "4k" download will never be 480p again)
An .exe? Doesn't everybody run their *arr stack on Linux? Well, that's what I do at least. Even so, crap like this has to be easily blockable. And I wouldn't mind if there was a service that handled that for everybody.
Yes but it’s a torrent, the target isn’t Sonarr, it’s manual downloads.
If you are too lazy to join private trackers, at least use TraSH guides to set up quality profiles
https://trash-guides.info/
I'm not too lazy to join a private tracker, I'm too lazy to maintain the presence necessary to use one. You're really signing up to be a part of a community. Mostly that's enforced through ratios, but those ratios are often set in such a way that you have to be uploading, or you have to be optimising what you choose to share in a way that gets you to those ratios. If the content you want is popular enough you just can't build ratio on it.
I've found the best way to do private trackers is to seed everything you download, all the time. If you seed enough of the long tail of things, ratio becomes easier. This also helps people get into a show that peaked a few years ago (after most of the seeders have moved on), which can be harder on public trackers.
Join how, exactly, and for what benefit? The private trackers I've heard of are not open or you have to pay to join (lol!). From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene. I bet theres a leaderboard somewhere with weektop and sitetop numbers. I'm too old for that shit.
If you are basic, then Torrentleech will cover 99.999% of your needs. It costs a few $ to join (a one time fee, and you get 1 month of free VPN), or just sign up for r/opensignups, and wait until they are open for registrations (typically once per year).
If you are too old for trackers, then just sign up for usenet. You will have to pay for it though.
> The private trackers I've heard of are not open… From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene
TBF this isn’t a revival of some arch 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.
>or you have to pay to join (lol!)
Why lol? Still better value than paying the IP holder what they want. And maintaining well curated torrent platforms costs money.
You can get into some not paying. You're just required to either have a minimum ratio or share several days, whatever's reached sooner (so you don't get stuck sharing something nobody wants for eternity).
In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.
> they also maintain ratios
This can get stupid sometimes like when they're expecting everybody to keep over 1.0 when there are people with 10.0; but usually when they're doing that it's because it's a scammy tracker (all private trackers that you have to pay to join are scammy no exceptions) and they're trying to extort people who fall below 1.0 to give them money.
But expecting people to upload is part of the deal. That's not about being old, that's about being selfish. Non-scammy private trackers make it very easy, and some just concentrate on gatekeeping and don't worry about ratios at all.
Your basic point is very true, though. The way many private trackers have lasted is to stop letting people in almost entirely. To get into a non-scammy tracker you have to know somebody irl who is on and active, and they still might not be able to get you in. Or they will pretend like they can't - inviters sometimes get punished for the quality of the people they invite, and you think sharing back is something children do.
A good private tracker will give you upload credit for keeping the torrent seeded even if no one downloads.
I'm on them for over 10 years. Last time I've cared about ratio was 9.
Does this website have a *.nix translation?
s/lazy/poor/
> It even grabs your Sticky Notes for WHAT????
The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way
Ran into the same issue, I created a small program that scans qbittorrent with their API and removes torrents that contain these file extensions and aren't downloading https://git.sbstp.ca/sbstp/qbittorrent-sentinel
Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.
Started running bitmagnet a few weeks ago after getting fed up with BTDigg dying and other DHT crawlers actually complying with DMCA notices for some reason (???). Pretty much everything even slightly popular that I search for has one of these EXEs lying around. Sometimes multiple.
https://github.com/cleanuparr/cleanuparr
Feels kind of weird that Windows Defender doesn't have something that catches this kind of behaviour? I mean if you have the Defender settings jacked up you're not going to be able to run executables anyway without a bunch of mucking around which should at least stop accidental running, but feels like some heuristics to stop these kinds of stealers should be a high priority for the Defender team. Not sure how you'd go about it though?
It's kinda funny because Windows Defender will catch some of these as Trojan:Win32/Ravartar!rfn
I find it funny that great minds think alike because I was just thinking of analysing these EXE files this week and doing a quick writeup at medium:
https://lazherrera.medium.com/analyzing-that-exe-file-youre-...
Defender automatically removes malware (or more correctly, game cracks it thinks are malware) the second it hits my disk from my torrent client.
But usually I'm downloading TV on Linux not windows
The new sonar version v4 has made it even more easy to get around this. But yeah. You can configure sonar better
Sonarr could have ignored those EXE filetypes, no?
> XOR a global. XOR it back. Do nothing. Hundreds of times. It exists purely to make the decompiler output look like shit, and it does, congrats.
No, that's to exhaust sandboxing without being able to trust sleep() or time API calls by the only way you can: generating heat.
The same happens for other series as well! I was frustrated with it! Good thing you decompiled this monstrosity
Haven't seen this on usenet so far. Wonder if its more torrent prone.
Got this in my sabnzbd instance and had to do .exe rules there too. An exe in a linux container…very smart.
I’m as upset as OP, get a job skid.
It's by far the most common on public torrent trackers, but I occasionally see it on usenet too. Never bothered to check which indexers they tend to come from.
Ince I discovered usenet I rarely want to deal with torrents
As someone who still pays for usenet, the benefit of torrents is anything older than a couple of days, since stuff gets pulled from usenet servers almost as soon as it's posted. Of course, if you have everything pre-configured to find and grab everything you're interested in, you won't even notice, but sometimes I just get an itch to watch something older off the cuff, and that's where torrents shine.
Skill issue. Configure your Sonarr better.
Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.
Scammers always have a new trick up their sleeve.
An excellent read. Thank you. I enjoyed it!
You don’t block it in qbittorrent, you let it download and then get sonarr to block the torrent when it detects an exe.
And also, stop posting claudeslop. We know it’s claudeslop. You tried really hard to modify it and conceal it, but you can’t fool a sloprunner. So please, just write your own fucking article. It’s like 4 paragraphs long.
It's Claude with a "slang+profanity" filter lol. The cadence is so tired and grating.
> malware
> you let it download
Sounds like a terrible strategy to me
I got sick of this shit a few weeks ago, so now as soon as the torrent client starts downloading an executable it removes the torrent. Definitely seems to be an increase recently.
This has been a thing since torrents have existed.
Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.
Plenty of my iso's intentionally contain those names though. Really, sonarr / radarr should have implemented this a long time ago since they're the ones doing the searching, downloading, and inspecting of files: https://github.com/Sonarr/Sonarr/pull/8775
Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.
Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.
Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.
The setting works on filenames, not titles.
> Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc.
This is literally one of the advice points at the end of the article. Did you get that far?
Join a private tracker and never think about it again
yeah!
let's all join a private tracker!
that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.
/s
how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?
> a burning of the library of alexandria loss-of-history what.cd style event again
I don’t agree with that framing.
All metadata has been preserved and published, and the sucessor sites to what.CD have long outgrown it; and their successors will again. Anything you find missing, you can request and typically it will be filled within less than 24 hours.
I mean i just joined a private tracker and so I don't have to think about it. Several, actually. It's hard for me to imagine someone taking torrenting seriously enough to set up an arr stack and not belong to a private tracker. Beyond malware, there's the rightsholder spies on the public trackers, and I'm not trying to lose my ISP over copyright strikes.
And i also truly cannot understand what your point is. Trackers are not really legal, they come and go. I don't think a few hundred or even a few thousand HN users joining across the ecosystem is going to suddenly cause them all to get raided
Yeah, this whole post felt like some weird deja vu from 25 years ago on a web forum. "Bastards are putting malware exe's on file sharing, wtf??"
> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????
The ability to change it, dude. Have you never written a malware before?
Often a primary concern is the security response, so you want redundancy for the ability to work around enforcement action, such as website takedowns.
Hardcoding a scapegoat into the malware itself also buys you time, so that the first enforcement action is less likely to spend your backups right away.
> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.
People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.
Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...
Is this a joke? Who’s upvoting this? It should be titled “I didn’t even bother asking an LLM to configure my server”
the interesting element of the article for me wasn't "somebody put malware on a torrent site", it was how the author reverse engineered the .exe to see why the file ended up there
How the author *asked Claude to reverse engineer the exe
How is the *arr stack so fracking complicated? Once upon a time, all you needed was a browser, a torrent client, and VLC. Maybe your torrent client had an RSS feed built in.
Now you need 9 different pieces of software that end in *arr, all of which implement parts of the solution that you want and parts that you don't, and none of them is even a torrent client!
And they don't even work with torrent sites reliably, so people then spend money on a Usenet subscription like it's 1990 again.
You can still manually download a torrent, open it in your client, and then open the file in VLC.
You can also automate 99% of it with the *arr stack and completely forget about it.
What is the issue? There is more choice now?
It works great. Family loves being able to self serve media requests.
Blame copyright laws.
Any all-in-one solution is going to be considered illegal at face value if it is obviously designed to circumvent copyright.
But if you split all the pieces of the solution up into separate pieces of software that can't do much illegal by themselves, you can always claim plausible deniability as the maintainer.
After all, you aren't going to be downloading torrents with Sonarr, you aren't going to be looking up information about shows with Jackett, and you aren't going to be automating your downloads with qBittorrent. If you link them all together with APIs, though, they do everything automatically.
As for the issue demonstrated here, it's just a long-standing problem in Sonarr and Radarr that even when it detects that a torrent is bad, it just sits there holding onto a virus until you override it with a working torrent, instead of just dumping the bad data and trying again.