When did CNET become a hive of malware?

Found a RAR file that'd been sitting around for a while without being unpacked.  Can't remember what it is.

Turns out it's password-protected.

Look for a RAR password cracker.  Oh, look: there's a promising-looking one, for Windows, downloadable from CNET.  Guess I can run it on my Windows VM.

But wait: Joy has reported having picked up nasty malware on her PC, twice in the last few months, apparently from things she'd downloaded from CNET... which, last time I was looking for Windows freeware, used to be a reputable source.

So: caution is in order.  Set a restore point... well, first, do a disk cleanup, then zero the free space, then bzip up the whole VM (that zero-the-free-space step makes a huge difference in the resulting file size).  After that, set a restore point, then install the downloaded program.

Immunet promptly notifies me that it's quarantined two trojans.

Hokay!  Back to the restore point, the RAR still undepasswordized.

Looking around, it appears that tales of unwanted toolbars and trojans coming from CNET started last December.  And... still going?

WTF?