Please note the difference between *are/is* installed, and *were* installed. I would expect dpkg -S to fail if those packages had been wrongly removed (corrupting dpkg database) but the pam and man files are extremely unlikely to be the result of malware. The OP never responded to my query about the other files that would have been installed - or checked the installation history with dpkg --get-selections (it won't show if purge was run, but then, those files would likely not be left).
Sorry I didn't follow up on this one... What info did you requested? How can I check if the package was installed (but is there no more)? I believe that dpkg --get-selections shows only available packages.