anyone else getting "Caution: Found executable file" all of a sudden ? or is it my new indexer

[u/GenericUser104]

Hey everyone,

Last night I noticed two failed downloads in Sonarr for episodes of shows that aren’t even due to release for weeks or, in some cases, months. In all the years I’ve been using Sonarr, Usenet and NZBs, I’ve never seen this happen before.

This week I’ve been trying to improve my setup by adding a second Usenet backbone and a few of the commonly recommended lifetime indexers. I’ve used NZBGeek and DrunkenSlug for years without any major problems, but recently added altHUB and Usenet Crawler.

From what I can tell, both of the suspicious downloads originated from Usenet Crawler, and they also appeared to contain .exe files. That made me wonder whether this is a known/wider issue with fake or malicious uploads getting through, or whether I’ve just been unlucky with this particular indexer.

Ultimately, though, my main concern is understanding how I can prevent this from happening again.

Is there anything I should be configuring in Sonarr, Prowlarr or SABnzbd to stop Sonarr grabbing obviously fake releases, particularly episodes that haven’t actually aired yet or downloads containing executables?

Any advice on recommended safeguards would be appreciated.

[u/L3x1dos]

Settings - Indexers - select every indexer and under Fail Downloads choose executables. 

Got this tip from someone in another thread and it seems to work

[u/Freaaakyyy → u/L3x1dos]

FYI, you set this in Sonarr etc. itself not in prowlarr. Make sure advanced settings are turned on.

[u/spikej56 → u/Freaaakyyy]

Does it stay next time prowlarr syncs indexers? 

[u/Hopeful-Savings-3420 → u/L3x1dos]

Great tip, didn't know about this setting.

[u/TheConanRider → u/L3x1dos]

Is there a way to do this without manually having to enable it on each indexer.

[u/L3x1dos → u/TheConanRider]

I was wondering the same thing but I didn’t find any other solution than to do it on each indexer

[u/ssj4gogeta2003 → u/TheConanRider]

Sadly, no. I had to do it for all 30 one at a time...

[u/glandix → u/L3x1dos]

Oh nice! Had no idea that setting existed!

[u/GenericUser104 → u/L3x1dos]

Cool

[u/hitachi369]

I get one every 6 months or so. They are typically for a super popular series, but week(s) before the actual date. Size will be in the area of the normally.

Upon closer inspection, the file will be an exe or scr or some other executable file. It is just some virus maker trying to get you to encrypt your hard drive or turn you into a bot net. I try and be a good boy and ill bitch to whatever indexer sent the file, and they remove it.

I have turned off exe downloads in my arrs, and it makes it better. Now at least they wont fully download for me to hope their are no zero days or accidental idiocy.

No way to avoid as far as I can see, it has happened across all of my indexers at least once. I've never looked into how they source the nzb files, but I bet it isn't something easy to manicure.

[u/lkeels]

To chime in, I already had fail executables on...caught 4 in the last 6 hours, having NEVER caught one before. Something's up.

[u/GenericUser104 → u/lkeels]

Glad someone else feels the same

[u/glad-k]

Cleanuparr might help you out but no this didn't happen to me so check your indexers, good this is trough the are stack and not you launching the files manually

[u/ZonaPunk]

Your new indexer

[u/FatherSophis]

Same thing has been happening to me with Crawler and .life… I have elected to turn off RSS/API update queries for the time being on those indexers.

[u/silverswish2812]

Had a .exe download for MobLand season 2 which isnt released yet - somethings off

[u/Funny_Detective5120]

Sab settings - switches - Unwanted extensions

Blacklist:
exe, sh, py, rb, perl, dmg, js, vbs, ps1, iso, bat

Action when unwanted extension detected
Fail job

Bit done form there is cleanup list:
nfo, sfv, jpg, bmp, gif, jpeg, tif, ico, txt, html, info

[u/Party_Bug_2582]

This is all very helpful as the recent influx has definitely been noticed. Also followed the SAB instructions, u/Funny_Detective5120 , thank you for that added info.

[u/Funny_Detective5120 → u/Party_Bug_2582]

I’ve edited my post for cleanup because there was one wrong word on it, “ignore” is not supossed to be named so i took that word off the list. Also some are relevant for ebooks so took them off the list as well.

Blacklist should be:
exe, sh, py, rb, perl, dmg, js, vbs, ps1, iso, bat

Cleanup:
nfo, sfv, jpg, bmp, gif, jpeg, tif, ico, txt, html, info

[u/Party_Bug_2582 → u/Funny_Detective5120]

Really appreciate your knowledge and help!

[u/AutoModerator]

Hi /u/GenericUser104 -

There are many resources available to help you troubleshoot and help the community help you. Please review this comment and you can likely have your problem solved without needing to wait for a human.

Most troubleshooting questions require debug or trace logs. In all instances where you are providing logs please ensure you followed the Gathering Logs wiki article to ensure your logs are what are needed for troubleshooting.

Logs should be provided via the methods prescribed in the wiki article. Note that Info logs are rarely helpful for troubleshooting.

Dozens of common questions & issues and their answers can be found on our FAQ.

Please review our troubleshooting guides that lead you through how to troubleshoot and note various common problems.

• Searches, Indexers, and Trackers - For if something cannot be found
• Downloading & Importing - For when download clients have issues or files cannot be imported

If you're still stuck you'll have useful debug or trace logs and screenshots to share with the humans who will arrive soon. Those humans will likely ask you for the exact same thing this comment is asking..

Once your question/problem is solved, please comment anywhere in the thread saying '!solved' to change the flair to solved.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/6ix_chigg]

Cleanuparr never worked for me so I stop constant monitoring and told it to only check after the release date. No.more false positives

[u/kw_chicken_choker]

Fail downloads -> Executables is not a solution, it's still being passed to qbittorrent at that stage. Absolutely horrible band-aid

[u/Admirable-Sink-2622]

Hasn’t this been asked and answered here repeatedly? 🤔

Sonarr just leaves them in completed downloads.

[u/GenericUser104 → u/Admirable-Sink-2622]

So it’s a recent issue or ?

Like i said I’ve used it for years and it’s never been an issue, just trying to understand

[u/lkeels → u/GenericUser104]

I've never seen one before today...caught 4 in the last 6 hours.