211

PSA/HOWTO: Avoid fake mkv torrents. Avoid getting hacked (lemm.ee)

submitted 2 months ago by American_Jesus@lemm.ee to c/piracy@lemmy.dbzer0.com

41 comments fedilink hide all child comments

There are some torrrents showing up with .lnkextension (ex: movie.mp3.lnk, tvshow.mkv.lnk...) and automated software (Sonarr, Radarr, Lidarr, qBittorrent RSS Downloader) could pick those torrents (but not import).

These (fake) torrents include a .lnk file that executes a script on your Windows

HOW TO exclude from download on qBittorrent.

Go to Options -> Downloads
Enable "Exclude file names"
Add patterns:

(one by line)

*.mp4.lnk  
*.mp3.lnk  
*.mkv.lnk
*.torrent.lnk

Or exclude all together: *.lnk

Example on VirusTotal https://www.virustotal.com/gui/file/e74f64df6ebaf3a1b6e3f42591eb6e87d2ac2828eb5a99fd8d3d82c140137fc9/detection

you are viewing a single comment's thread
view the rest of the comments

[-] ReversalHatchery@beehaw.org 153 points 2 months ago

thanks Microsoft for hiding extensions by default!

[-] wizardbeard@lemmy.dbzer0.com 39 points 2 months ago* (last edited 2 months ago)

Yes, but also whoever set the defaults for the *arr tools. Why would any filename with extra shit past the extensions you're looking for be considered an acceptable result?

Tack $ on the end of your regex, for fucks sake.

[-] American_Jesus@lemm.ee 9 points 2 months ago* (last edited 2 months ago)

Is not regex
https://github.com/qbittorrent/qBittorrent/pull/17106

Examples
*.exe: filter '.exe' file extension.
readme.txt: filter exact file name.
?.txt: filter 'a.txt', 'b.txt' but not 'aa.txt'.
readme[0-9].txt: filter 'readme1.txt', 'readme2.txt' but not 'readme10.txt'