Audit a homelab and catch malware posing as videos on a NAS

The poster, a chemical plant operator rather than an IT worker, runs a homelab with servers, websites, scripts, backups and self-repairing update automation. The agents that touch their machines work under fixed rules: a restore point before each change, a guard that blocks destructive commands, no irreversible step without approval, and every change as a pull request they review. They first asked Opus 5.5 for a full audit, then ran the same audit with Fable 5.2 and told it to question everything built so far. While cleaning an old 2 TB download folder, the agent built a read-only inventory and matched each video against the media library by exact file size.

The Opus 5.5 audit suggested improvements but found nothing suspicious. The Fable 5.2 run found three fakes that had sat in the folder for a long time: two "movies" that were Windows executables and one "TV episode" that was a 1.1 GB Windows shortcut. It did not open them. It flagged them, explained that they could not run on the Linux NAS but could infect a Windows PC that opened them from the network share, and waited for the poster's go-ahead before doing anything.

The safety came from the setup, not the model: read-only inventory first, restore points, a command guard and approval before any change. The post names only the model, not the harness that ran it. Matching files against a library by size is a cheap check you can run on any media share.