Widcomm uninstall, best virus ever

Hi,

 

I do not know the right place where this should be posted. Trying here.

 

Last friday I installed latest Broadcom Widcomm drivers for Bluetooth USB dongle (http://www.broadcom.com/support/bluetooth/update.php).

 

My OS was Windows 7 Home Premium 64bit, updated with latest patches available that day.

 

Installation went smooth, but having found no major benefits from the new drivers (I had a pairing problem with a device, not solved by the new drivers), I decided to uninstall widcomm (I always prefer keeping the system the cleanest possible).

 

I started the uninstall procedure from windows control panel (uninstall software, of course from an admin account), and made the big error doing something else the following 20 minutes.

 

When back, I realized the uninstall procedure was deleting any file I had on the PC: programs, setups, OS...

 

Likely, process was running as admin user and was not able to delete my personal files (for all my personal accounts I have removed the right for admin to access files: to do that, first admin has to modify access rights), so I've not lost any personal data, but that obliged me to reinstall the system from scratch (no way to recover in any manner).

 

Surprisingly (but not that much), Norton Internet Security didn't flag any dangerous activity: I understand that was a standard uninstall procedure, but euristics should have found the activity was too heavy, with deletion running not only on the folder the drivers+utility were installed but touching and erasing anything on the disk.

 

Also, making some trials I realized even the installation process is a bit suspect (it disables, for example, the automatic save & recovery), and even here no highlights on the modifications to the system the installation procedure is doing.

 

I went no further in analyzing the drivers (of course I wrote to Broadcom, I'm waiting an answer from them), focusing on the reinstall of the system.

 

It would be interesting if someone from Symantech could replicate in lab what happened to improve NIS on this kind of events.

 

Thanks