I dont know what is causing but i tried tons of fixes, i mainly use public torrenting, and sonarr and radarr are doing it.
I added *.arj and arj to the quality profile avoid list without success, and prowlarr is as torrent (i’ve read sometimes it gets confused and uses nzbget)
In Qbittorrent you can tell it to not download certain files. So you can tell it to ignore anything with *arj, for example.
I’ve had this happen with people pretending to be certain groups and making the file a .lnk (a link to a website, I assume). Sonarr will still send the file to Qbittorrent, but it won’t get downloaded at all.
I got one so I picked it apart. The link runs a script on the local system that downloads a kubernetes runtime. From there I assume it runs a Bitcoin miner or something, I didn’t go any further.