Hidden NIS 21.0.2.1 Rootkit after uninstall

Just removed NIS 21.0.2.1 and installed the Avast 2014, but Avast find there are Hidden Rootkit from NIS and the boot log show hidden files too:

http://i.imgur.com/CgFgIdi.png


avast! Antirootkit, version 1.0
Scan started: October 16, 2013 19:42:40


File: C:\Windows\system32\drivers\NISx64\1500020.001\ccSetx64.sys SignCode: 123 0 0
Service ccSet_NIS [C:\Windows\system32\drivers\NISx64\1500020.001\ccSetx64.sys] **HIDDEN**

File: C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.2.1\Definitions\IPSDefs\20130805.011\IDSVia64.sys SignCode: 123 0 0
Service IDSVia64 [C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.2.1\Definitions\IPSDefs\20130805.011\IDSVia64.sys] **HIDDEN**

File: C:\Windows\system32\drivers\NISx64\1500020.001\SRTSPX64.SYS SignCode: 123 0 0
Service SRTSPX [C:\Windows\system32\drivers\NISx64\1500020.001\SRTSPX64.SYS] **HIDDEN**

File: C:\Windows\system32\drivers\NISx64\1500020.001\SYMDS64.SYS SignCode: 123 0 0
Service SymDS [C:\Windows\system32\drivers\NISx64\1500020.001\SYMDS64.SYS] **HIDDEN**

File: C:\Windows\system32\drivers\NISx64\1500020.001\SYMEFA64.SYS SignCode: 123 0 0
Service SymEFA [C:\Windows\system32\drivers\NISx64\1500020.001\SYMEFA64.SYS] **HIDDEN**


Scan finished: October 16, 2013 19:43:04
Hidden files found: 0
Hidden registry items found: 0
Hidden processes found: 0
Hidden services found: 5
Hidden boot sectors found: 0



....Is Norton/Symantec doing NSA things??

 

I guess you reset the system after uninstall and before you installed Avast?

You can use Norton removal tool and see if it removes those files:
https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us

 

Those are normal Norton drivers... The only issue here is that the uninstaller isn't removing all leftovers, not any conspiracy theory mumbo jumbo.

Besides, most security software leave hidden drivers behind after a normal uninstall. Including Avast.

 

Although I like the way you think, Apm, those files are just residua from a shoddy uninstall routine. As there is nothing to activate these files and can't intrinsically connect out they can't be considered Backdoors. Follow tomazyk's suggestion and/or delete manually.

And don't be concerned about your being currently monitored by the NSA. They already know enough about you to be satisfied.

 

LoL

 

MEAN.

 

with symantec i wouldnt put it past them though...