Invisible Malware Install 65MB Large

Paperghost writes "Words fail me with this one - don't have the .NET framework on your PC to utilise the adware maker's technology? No problem, they'll download it for you without you knowing. The problem is that it's a sixty-five megabyte install." From the article: "...the size of the .NET framework to download can vary drastically depending on what extras you have - don't forget the service packs, SP1 is an extra 10 or so MB in size. But I'm actually understating the amount of space used when installed, as .NET can total up to 100MB."

Comments

Marc Lucovsky!

[Jacco de Leeuw]

Hey, at least somebody has been listening to Marc Lucovsky!

Consider the .NET framework for a second. Suppose you wrote something innocent like a screen saver, written in C# based on the .NET framework. How would you as an ISV "ship your software"? You can't. Not unless you sign up to ship Microsoft's software as well. You see, the .NET Framework isn't widely deployed. It is present on a small fraction of machines in the world. Microsoft built the software, tested it, released it to manufacturing. They "shipped it", but it will take years for it to be deployed widely enough for you, the ISV to be able to take advantage of it. If you want to use .NET, you need to ship Microsoft's software for them.

Who said Microsoft does not know how to ship software anymore?! Let the trojan authors take care of that!

Re:a lot of space

[tehshen]

It's a 65MB install, but only a 24MB download. From TFA:

the actual size of the .NET framework to download is around 23MB, though this is still a lot of bandwidth to use up without asking. In addition, the size of the .NET framework to download can vary drastically depending on what extras you have - don't forget the service packs, SP1 is an extra 10 or so MB in size.

So once it's done its thing and installed .NET, it takes up 65MB.

the problem is the malware

[idlake]

The .NET download is just part of Windows now; sooner or later, you will need it, whether you want it or not. 65M is not all that large compared to other runtimes and libraries (C/C++ is much larger).

The real problem here is that somehow these machines installed malware. The problem could be that they are running IE, it could be that the malware is exploiting a bug, etc.

There is a simple solution: run Linux instead. That will protect you from both malware and .NET.

Re:65 MB without the user knowing?

[Omega1045]

I would not say that the .Net framework is huge in comparison to, say, Java. The Java 1.4.2 runtime (no SDK) core is 15 MB. The core .NET 1.1 runtime my company distribute with our software (the clients know they are getting it) is 19 MB.