Rootkit-like Feature Found in Norton Systemworks

GenieGenieGenie writes "eWeek reports a rootkit-like 'feature' in Symantec's Norton Systemworks, discovered by the Mark Russinovich, who was also responsible for blowing the whistle on Sony's DRM rootkit. The cloaked directory is intended to prevent users from accidentally deleting important files, but could compromise a system by serving as a hiding place for malware, as was the case with Sony's rootkit. Russinovich says Symantec had good intentions, but they were right to post an update to fix this hole."

Comments

I don't trust their intentions

[m50d]

Given the way Norton will not uninstall without downloading a separate removal tool (and the fact they've known about this for five years but continue to ship versions that won't uninstall) I have zero confidence in Symantec having had good intentions with this.

Re:Before the flame wars start...

[pipingguy]

Since we were covering the non-evilness of cookies last week, why is it that index.dat is never discussed? What does it contain and why is it tied so much to the OS?