Can an incorrect program size indicate malware?
Example File Sizes from "Programs and Features":
Windows is reporting vastly incorrect file sizes. In the example given, Python 3.4.1 is listed as taking 30 GB of space. This isn't the only program on this machine that should be very small (under 100 MB) and is listed as at least 30 GB.
Could this indicate something else on my computer disguising itself as such a program that MalwareBytes and my anti-virus do not pick up (or have taken care of but have not cleaned up after)?
There is no slowness or indication of any problem related to Malware or any such thing. I originally attributed this as a quirk of Windows 10, as it hadn't been noticed before then. It hasn't changed throughout Windows 10 updates, so I'm considering otherwise.
If it is something bad or the remnants of such thing, is there any way to determine where that data is that Windows is looking at so it can be removed? If not, is this a common issue that has a solution so that Windows reports the correct sizes?
Probably not.
The Size column isn't actually a total of any file sizes. As of Windows 7, the value that appears there is always supplied by the installer at install time. If no value is specified by the program, the column is left blank. Even if malware added a boatload of files to those programs' installation folders, the reported size in that window wouldn't increase at all. The only possible reason for the value to change would be that something intentionally updated the program's uninstall registration, and I doubt malware would do that.
The most likely cause is that those programs simply provided an incorrect value for their estimated size. Either that, or the Windows 10 upgrade did strange things to the registration.
For the curious, you can find uninstall registration in the Registry here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Each program's subkey can contain a value called EstimatedSize
, which is the reported size in kilobytes.
Historical note: Before Windows 7, in the absence of the EstimatedSize
entry, Windows would crawl around your disk to guess how big the program is.