Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.
Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.
Join how, exactly, and for what benefit? The private trackers I've heard of are not open or you have to pay to join (lol!). From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene. I bet theres a leaderboard somewhere with weektop and sitetop numbers. I'm too old for that shit.
> The private trackers I've heard of are not open… From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene
TBF this isn’t a revival of some 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.
You can get into some not paying. You're just required to either have a minimum ratio or share several days, whatever's reached sooner (so you don't get stuck sharing something nobody wants for eternity).
In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.
Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.
As someone who still pays for usenet, the benefit of torrents is anything older than a couple of days, since stuff gets pulled from usenet servers almost as soon as it's posted. Of course, if you have everything pre-configured to find and grab everything you're interested in, you won't even notice, but sometimes I just get an itch to watch something older off the cuff, and that's where torrents shine.
Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.
It's by far the most common on public torrent trackers, but I occasionally see it on usenet too. Never bothered to check which indexers they tend to come from.
Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.
Plenty of my iso's intentionally contain those names though. Really, sonarr / radarr should have implemented this a long time ago since they're the ones doing the searching, downloading, and inspecting of files: https://github.com/Sonarr/Sonarr/pull/8775
Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.
Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.
Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.
that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.
/s
how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?
> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????
The ability to change it, dude. Have you never written a malware before?
Often a primary concern is the security response, so you want redundancy and the ability to work around enforcement action, such as website takedowns.
> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.
People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.
Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...
Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you needing to manually intervene. You may also have to tweak some conflicting settings on qbit.
Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.
If you are too lazy to join private trackers, at least use TraSH guides to set up quality profiles
https://trash-guides.info/
Join how, exactly, and for what benefit? The private trackers I've heard of are not open or you have to pay to join (lol!). From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene. I bet theres a leaderboard somewhere with weektop and sitetop numbers. I'm too old for that shit.
> The private trackers I've heard of are not open… From what I understand they also maintain ratios and seeders race to get credit for newly uploaded files. Its the 2026 version of the 90s warez courier scene
TBF this isn’t a revival of some 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.
You can get into some not paying. You're just required to either have a minimum ratio or share several days, whatever's reached sooner (so you don't get stuck sharing something nobody wants for eternity).
In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.
I'm on them for over 10 years. Last time I've cared about ratio was 9.
> It even grabs your Sticky Notes for WHAT????
The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way
Everything got flooded with those exes, not just South Park. All most seeded TV episodes on most public trackers were (are?) those EXEs. It will be interesting to know who launched the attack.
https://github.com/cleanuparr/cleanuparr
Sonarr could have ignored those EXE filetypes, no?
An excellent read. Thank you. I enjoyed it!
The same happens for other series as well! I was frustrated with it! Good thing you decompiled this monstrosity
Ince I discovered usenet I rarely want to deal with torrents
As someone who still pays for usenet, the benefit of torrents is anything older than a couple of days, since stuff gets pulled from usenet servers almost as soon as it's posted. Of course, if you have everything pre-configured to find and grab everything you're interested in, you won't even notice, but sometimes I just get an itch to watch something older off the cuff, and that's where torrents shine.
Welcome to piracy, you must be new here. This has been occurring for some time, I've seen it for years to occasionally find a media named exe to delete and manually redownload.
Scammers always have a new trick up their sleeve.
Haven't seen this on usenet so far. Wonder if its more torrent prone.
Got this in my sabnzbd instance and had to do .exe rules there too. An exe in a linux container…very smart.
I’m as upset as OP, get a job skid.
It's by far the most common on public torrent trackers, but I occasionally see it on usenet too. Never bothered to check which indexers they tend to come from.
Tell your downloader (in my case qbittorrent) to not download .exe, .scr, .zip, etc, etc, etc. It’s been this way for years. You do have to clean out qbittorrent every few days so that sonarr will search again, so that’s a pain. But hey, I’m pirating media. Someone trying to scam me at the same time is expected.
Plenty of my iso's intentionally contain those names though. Really, sonarr / radarr should have implemented this a long time ago since they're the ones doing the searching, downloading, and inspecting of files: https://github.com/Sonarr/Sonarr/pull/8775
Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.
Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.
Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.
Yeah, this whole post felt like some weird deja vu from 25 years ago on a web forum. "Bastards are putting malware exe's on file sharing, wtf??"
Join a private tracker and never think about it again
yeah!
let's all join a private tracker!
that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.
/s
how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?
This has been a thing since torrents have existed.
> But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????
The ability to change it, dude. Have you never written a malware before?
Often a primary concern is the security response, so you want redundancy and the ability to work around enforcement action, such as website takedowns.
> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.
People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.
Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...