Looks like you downloaded a bogus client. Scary stuff. The client at the front page of this thread is legit. You need to calculate the hash256 of the zip file of your client and compare to the hash in the 0.4.8 in the front page. They have to match exactly.
As you said you have two same client with 5Kb difference in size. One is certainly bogus. Sorry for your loss. This should really be sticky.
I could have fallen for this since I never checked the file until today.
But for now, only use client file from trusted source and do a checksum hash256 the zip file before using.
This needs to be in wiki and the front page.
If this is correct, then PaulyC please upload the bogus client somewhere and post the link (or give its original link); it would be interesting to see it.