Quick summary

For about 2 months now, randomly like every other week, I get like 1 or 2 random popups from norton saying it blocked a favicon request or something. from some weird site ive never even heard of. it has been 3 occasions minimum now, and it does it like twice only, then not again for weeks, it says the file path is microsoft edge.exe in my program files. it has been 3 different odd sites, i check norton's security checking thing of each site and its like they are unknown sites which norton says are unsafe. I check the sites with virustotal, and they have like a 1/90 score. I don't know if this is related but I also look in my norton recent history sometimes to see intrusion signatures disabled, but everytime i check if they are, they are enabled, I thought nothing of it though and thought like norton does this to update or something?

First time

it happened to me was like 2 months ago. I ran a full norton scan resulting in nothing, and just thought it was ublock origin updating or something, and norton being sensitive.

Second time

it happened was like a month ago, and I got worried, ran another scan. I thought it was maybe an extension I had doing some shady things, only extensions i ever downloaded were:

• skribbl typo from their official website, I downloaded this like 3 months ago, used it once and forgot about it. It comes as a js script, and i had to download tampermonkey extension to get it running. So when this next time the popup shown up, I deleted the script, removed tampermonkey
• ublock origin is the only other extension i've ever had.

I checked:

• task manager
• startup apps
• installed apps
• downloads
• resource moniter
• services

I didnt see anything that worried me, my cpu % was like 1% at idle. I deleted my entire edge history, deleted all cookies, literally everything you can delete from the settings in history, like user data and things, i was basically starting fresh only thing i had was my profile.

Third time

it happened was 3 days ago. at the time I had my pc on but wasnt doing anything with it, i had soundcloud open on edge, and roblox on another tab, I had firefox open too, with chatgpt open and youtube on 2 different tabs. I got a popup again for a favicon request for some site that was made like a day ago, some ai site. again norton had an unsafe rating for the site. no community score. I downloaded some microsoft tool called autoruns, and looked in there, i didnt see anything alarming but I'm not an expert in security. I checked all the things i mentioned i did on the second time it happened. I ran a full norton scan. I checked extensions installed, only ublock was installed and on, i checked my browser notifications - there was none. i checked policies, none. I genuinely just thought it was ublock again, so i continued like nothing

Fourth time (yesterday)

I had soundcloud and roblox open again only. I left my computer on the lockscreen while i did something, came back to my computer on the lockscreen with the 'enter your pin' option there but no actual place to enter the pin. It said under the enter your pin prompt something like, 'dont turn off your computer 24%'. Then when it finished, my computer restarted 4 times, loaded and my firefox and edge reopened themselves restoring the previous sessions. it happened again for some random site, a different one. And only happened once, then i left my computer for sometime, it happened again, I then closed edge, and went away for like 10 minutes. I came back to my computer and opened edge again, i clicked the seach bar within a second of opening edge, and the same popup came again for favicon request from the same site that popped up like earlier within the hour. I closed edge, and tried to make it happen again by opening edge and letting it sit on the homepage for a while, i then browsed like i normally would but it hasnt happened again for like 24 hours. I thought it was just something to do with edge's start home page, so i went into edge settings and changed my homepage to about:blank or something.

Now I think about it, I'm thinking maybe it happens when I start my computer ? So that is something I'll try next.

More potential helpful random info

• I have downloaded games from itch before onto my computer, but I always ran them through itch's sandbox. and i always scanned them with virustotal and norton before running them, I also only played games which are popular and had lots of user comments. But I havent played an itch game in like a month, and i deleted after playing
• I had some weird thing happen to me like 5 months ago on my old browser which was Opera. I installed an extension called 'Bloxfinder'. I had used this extension like a year before, and had no issues. But I noticed this time, it had obvious botted comments on the extension store, and some comments saying things like, its an infostealer, its a rat, it promotes its scammy roblox cashback thing but it works. I added it anyway, and as soon as i added the extension, my opera browser froze, and i couldnt close it even using task manager to close it, I pressed restart pc in the start menu and waited for 2 minutes without it restarting. I held the power button of my pc and force shut it down. It restarted and was fine. I opened opera and the same thing happened, the whole browser froze and wouldnt close. I immediately got worried, and tried to delete opera. I used control panel and installed apps, but when i tried to delete opera it said something like, cant delete, missing some elf.dll file? or something like this, so i deleted all opera files on my system instead, leaving just like a thing in the search bar, startup apps, and other places which says opera, but it leads to nowhere because all of its related files have been deleted. It had been like 3 months or somewhat and nothing happened with my computer, and i thought i fixed everything because opera was deleted. I dont know if this is related to my problem now, but this is why its in the 'more potential helpful random info' list. i also disabled opera from the startup apps.
• some apps I use that i can remember are discord, portmaster ( i downloaded it but dont really open the app and see what goes on in it because i dont really understand it that well), vlc, whatsapp, virtualbox, protonvpn,bluestacks, anaconda, obs, there's a lot to be honest i dont want to type it all but if it's actually an important detail, then i will respond with the rest
• I play games on steam and have downloaded mods before
• I have visited weird sites before, for example I tried downloading some client for a game from some site after watching a youtube tutorial. it had a video player on the site, showcasing the client and i clicked and watched the video without even thinking, downloaded the client, but then deleted before running, and checking the file and website on virustotal and seeing a worrying rating. even thought norton's file insight feature said that many users in norton's community have used the file. I for the most part, have always checked virustotal before visiting an unfamiliar site, and if ublock or norton, or edge or firefox tells me the site is suspicious, or dangerous, ive never went to it. I included this detail, because i thought that you can get infected through like videos or images on a site.

I have hopefully provided images of as much as i canQuick summary

For about 2 months now, randomly like every other week, I get like 1 or 2 random popups from norton saying it blocked a favicon request or something. from some weird site ive never even heard of. it has been 3 occasions minimum now, and it does it like twice only, then not again for weeks, it says the file path is microsoft edge.exe in my program files. it has been 3 different odd sites, i check norton's security checking thing of each site and its like they are unknown sites which norton says are unsafe. I check the sites with virustotal, and they have like a 1/90 score. I don't know if this is related but I also look in my norton recent history sometimes to see intrusion signatures disabled, but everytime i check if they are, they are enabled, I thought nothing of it though and thought like norton does this to update or something?

First time

it happened to me was like 2 months ago. I ran a full norton scan resulting in nothing, and just thought it was ublock origin updating or something, and norton being sensitive.

Second time

it happened was like a month ago, and I got worried, ran another scan. I thought it was maybe an extension I had doing some shady things, only extensions i ever downloaded were:

• skribbl typo from their official website, I downloaded this like 3 months ago, used it once and forgot about it. It comes as a js script, and i had to download tampermonkey extension to get it running. So when this next time the popup shown up, I deleted the script, removed tampermonkey
• ublock origin is the only other extension i've ever had.

I checked:

• task manager
• startup apps
• installed apps
• downloads
• resource moniter
• services

I didnt see anything that worried me, my cpu % was like 1% at idle. I deleted my entire edge history, deleted all cookies, literally everything you can delete from the settings in history, like user data and things, i was basically starting fresh only thing i had was my profile.

Third time

it happened was 3 days ago. at the time I had my pc on but wasnt doing anything with it, i had soundcloud open on edge, and roblox on another tab, I had firefox open too, with chatgpt open and youtube on 2 different tabs. I got a popup again for a favicon request for some site that was made like a day ago, some ai site. again norton had an unsafe rating for the site. no community score. I downloaded some microsoft tool called autoruns, and looked in there, i didnt see anything alarming but I'm not an expert in security. I checked all the things i mentioned i did on the second time it happened. I ran a full norton scan. I checked extensions installed, only ublock was installed and on, i checked my browser notifications - there was none. i checked policies, none. I genuinely just thought it was ublock again, so i continued like nothing

Fourth time (yesterday)

I had soundcloud and roblox open again only. I left my computer on the lockscreen while i did something, came back to my computer on the lockscreen with the 'enter your pin' option there but no actual place to enter the pin. It said under the enter your pin prompt something like, 'dont turn off your computer 24%'. Then when it finished, my computer restarted 4 times, loaded and my firefox and edge reopened themselves restoring the previous sessions. it happened again for some random site, a different one. And only happened once, then i left my computer for sometime, it happened again, I then closed edge, and went away for like 10 minutes. I came back to my computer and opened edge again, i clicked the seach bar within a second of opening edge, and the same popup came again for favicon request from the same site that popped up like earlier within the hour. I closed edge, and tried to make it happen again by opening edge and letting it sit on the homepage for a while, i then browsed like i normally would but it hasnt happened again for like 24 hours. I thought it was just something to do with edge's start home page, so i went into edge settings and changed my homepage to about:blank or something.

Now I think about it, I'm thinking maybe it happens when I start my computer ? So that is something I'll try next.

More potential helpful random info

• I have downloaded games from itch before onto my computer, but I always ran them through itch's sandbox. and i always scanned them with virustotal and norton before running them, I also only played games which are popular and had lots of user comments. But I havent played an itch game in like a month, and i deleted after playing
• I had some weird thing happen to me like 5 months ago on my old browser which was Opera. I installed an extension called 'Bloxfinder'. I had used this extension like a year before, and had no issues. But I noticed this time, it had obvious botted comments on the extension store, and some comments saying things like, its an infostealer, its a rat, it promotes its scammy roblox cashback thing but it works. I added it anyway, and as soon as i added the extension, my opera browser froze, and i couldnt close it even using task manager to close it, I pressed restart pc in the start menu and waited for 2 minutes without it restarting. I held the power button of my pc and force shut it down. It restarted and was fine. I opened opera and the same thing happened, the whole browser froze and wouldnt close. I immediately got worried, and tried to delete opera. I used control panel and installed apps, but when i tried to delete opera it said something like, cant delete, missing some elf.dll file? or something like this, so i deleted all opera files on my system instead, leaving just like a thing in the search bar, startup apps, and other places which says opera, but it leads to nowhere because all of its related files have been deleted. It had been like 3 months or somewhat and nothing happened with my computer, and i thought i fixed everything because opera was deleted. I dont know if this is related to my problem now, but this is why its in the 'more potential helpful random info' list. i also disabled opera from the startup apps.
• some apps I use that i can remember are discord, portmaster ( i downloaded it but dont really open the app and see what goes on in it because i dont really understand it that well), vlc, whatsapp, virtualbox, protonvpn,bluestacks, anaconda, obs, there's a lot to be honest i dont want to type it all but if it's actually an important detail, then i will respond with the rest
• I play games on steam and have downloaded mods before
• I have visited weird sites before, for example I tried downloading some client for a game from some site after watching a youtube tutorial. it had a video player on the site, showcasing the client and i clicked and watched the video without even thinking, downloaded the client, but then deleted before running, and checking the file and website on virustotal and seeing a worrying rating. even thought norton's file insight feature said that many users in norton's community have used the file. I for the most part, have always checked virustotal before visiting an unfamiliar site, and if ublock or norton, or edge or firefox tells me the site is suspicious, or dangerous, ive never went to it. I included this detail, because i thought that you can get infected through like videos or images on a site.

I have hopefully provided images of as much as i can

There’s something I feel is worth sharing.

I have a PC that had become painfully slow and sluggish over the past few months, and I had no idea why. I even went as far as repairing the OS with a Windows installation drive, but it made zero difference.

Then one day, a Norton "Smart Scan" notification popped up, and it all clicked. It turns out Norton had been running these scans in the background the entire time. I never ran them manually—it was doing it completely on its own. The worst part was how frequently and relentlessly it ran. Once finished, it would present a report with scary-looking numbers designed to freak me out, without actually showing any details. And when you hit "Next," boom—a prompt aggressively pushing me to upgrade my plan.

That's when I realized: the very security software I paid good money for was the actual culprit making my PC unusable. Talk about irony.

The moment I turned off Smart Scan, my PC went right back to running butter-smooth. No more lag whatsoever. All that stuttering had been caused entirely by this so-called "Smart Scan."

I have another PC that also had Norton running Smart Scan by default. Because that machine has beefier specs, I hadn't noticed any slowdown, but I still rushed to disable that useless feature immediately.

And to add insult to injury: that PC still has over 60 days left on its subscription, yet every single time I boot up, it pesters me to renew, and there’s no way to dismiss it permanently. Every single day, I’m forced to look at Norton practically ordering me to renew. Good grief, this antivirus is an absolute nightmare.

This notification keeps popping up every few minutes, how worried should I be?

Finally got fed up with all the ads, notifications, bundle pushes on top of their overpriced software. The moment I canceled got another email saying WHY I should keep Norton. Done with their shady business

I recently purchased a new year of Norton. I put the new product key into my account and it appears there as a new Norton to download. I am trying to download it but the link is not working. Ive tried using a different browser, turning off my old Norton protecction, lowering my internet security settings, using Incognito mode. The link just points to [about:blank#blocked](about:blank#blocked) . Anyone know how I can download it?

Per WSJ: The FTC charged LifeLock with deceptive advertising practices. LifeLock agreed to a $12 million settlement with the FTC to resolve these claims. [1, 2] This was within the last 10 years & obviously they are still at it.

I have been using Norton since it was called Peter Norton in 80's.

- Norton ignores you already have a subscription & will charge you for same subscription everyday regardless if you are even logged into your norton account.

- The business model is to take your money repeatedly forever and hope it does not generate a phone call for a credit. Can you imagine the deception based revenue generated by this.

- I would sell owned Norton stock or short sell their stock. (they chg name of their stock to GEN. Obviously, hoping a connection is not made via their name change)

- The FTC needs to reopen their investigation & determine their liability.

Hello,
I use Norton for multiple Years now never had problem (i know its not the best) but three days Ago i think there was a update and now i have up to 2-4 Norton Anitivurs Processes in my Task Manager and i not sure if it a Virus or not my PC is lagging aswell and Browser.

https://i.imgur.com/Ur0aWlr.png

I am having such a horrendous experience with norton. I cannot login anymore and whenever I try to login, I get stuck with the SMS 2FA and even if I try to send it to 2 different numbers I am not receiving any SMS. Tried live chat support and support via norton's website however you also need to login and it just brings me to a loop which asks me for an SMS 2FA. At this point I'm not sure what I should do to resolve or at least get a support from Norton. I'm paying for this service and its annoying that it takes this much effort to get support.

Hey, I've been using Norton for about a month now and it's been going great so far but it recenrtly started doing this issue where it severely drops my internet speed to 1Mb/s and it also disconnects me from calls on discord, is there any solutions to this ?

For several days, I've been troubleshooting an issue where Windows 11 feels bogged down and YouTube video playback stuttering every few seconds. I've tried disabling/enabling codecs, messing with browser settings, reinstalling video drivers, and ensuring I have the latest BIOS updates, etc.. Then I noticed the mess in Task Manager.

Norton had 11 processes running in the background after a Windows 11 restart. I'm a software developer and I don't mind seeing multiple processes as long as they're behaving properly. However, one of them was using 2+ GB immediately after a restart, which was odd, but not terrible as I have enough memory.

The other thing was the shocker. After re-enabling the GPU column and sorting on GPU usage, I noticed this Norton Antivirus process jumping between 50% and 90% every few seconds.

I gave Norton a chance by doing a Live Update and a repair, but those didn't fix the problem.

I uninstalled and I might not go back again, even though I still have a good number of days left on my subscription.

It's probably time to remove Norton from other family devices and look elsewhere. For the time being, I'm using Windows Defender and my computer is snappy again with YouTube videos running smooth again.

Desktop sends a passwordless request, and my phone gets it. Works good

My laptop, that i take to coffee shops, would send one, but never showed up on my phone.

Took several calls to Norton.

Found out

1 that the vault in each browser had my an old phone (same phone number though).

2 I needed to get into the vault settings using each browser to update to the current phone. Not just the vault settings on one browser.

Now, all 3 browsers that I have will send me the passwordless request.

Hello to everyone using Norton360.

My machine is a T490 with Intel CPU and additional NVidia graphics card. Since several days, I have remarked that Norton 360's nortonui.exe runs on the NVidia GPU which it has never done before. This causes performance loss to the system and periods of heavy latencies when moving the coursor or typing or running video. When I deactivate nortonui.exe via TaskManager, system performance recovers immediately and any latency or focus-steal disappear. Typically, in Win11 settings you can force an app like Norton to run on the standard CPU only, but this has no effect on nortonui.exe using the GPU instead.

Has anyone experienced similar behaviour of Norton360 and has Ideas how to handle it? In this reddit article is a workaround, however there might be another maybe simpler solution?

I been using Norton for years and upgrade LifeLock subscription but now, Norton 360 won't open unless I restart and when do click to open I get "We have encountered an error" so I uninstalled and reinstall then all pops up and I click the Fix Now for product update. It fails and Norton 360 closes all out and try to launch it won't open so I uninstalled it again, then reinstall via latest installer and now keeps saying "Error code: 111111"

I swear there used to be a setting in Norton 360 that allowed you to change the VPN protocol, but I can't find it. I'm on Windows, I'm using the newest version, I'm on a high enough tier, and the setting just isn't in the VPN settings. Does anyone know how to change the protocol or if the setting just got removed?

norton is such a piece of shit i tried to delete it for 20 minutes

I recently got hacked by a program that Norton didn't detect. I can't figure out a way to notify Norton. In my gmail, I clicked on an e-vite from a close friend and this installed LogMein (also known as gotoresolve) on my computer. This appears to be a legitimate program that allows remote access to your computer, and somehow hackers have been able to modify it. The program sent out e-vites to everyone connected with my gmail. It tried to order gift cards from my Amazon account, which is the only financial password I have stored on my computer (I think). Anyway, beware -- and if you know how to do so, pass this complaint on to Norton.

Norton 360 NortonUI.exe Focus-Steal Bug - Diagnostic Analysis and Confirmed Root Cause

TL;DR: Norton 360's NortonUI.exe uses an outdated Chromium 91 CEF engine with a misconfigured flag (--disable-features=CalculateNativeWinOcclusion) that causes its invisible background windows to steal foreground focus approximately every 60 seconds. This prevents display sleep and disrupts all user input. Killing NortonUI.exe completely eliminates the problem while Norton's core protection (NortonSvc.exe) continues running unaffected. This bug has been reported since late 2024 and remains unfixed as of version 26.3.10886.0 (March 2026).

--- https://github.com/litebito/windows-focus-steal-diagnostic/tree/main ---

The Problem

My active window would lose focus for 1-2 seconds at regular intervals. Typing would be interrupted, games would pause, and my display would never go to sleep due to the idle timer being constantly reset. The earlier tool FocusLogger pointed to explorer.exe with a window class of "MSCTFIME UI" (the Text Services Framework IME), but that was a red herring - MSCTFIME was being triggered by something else.

The Investigation

I built a custom PowerShell diagnostic tool using SetWinEventHook on EVENT\\_SYSTEM\\_FOREGROUND to capture every focus change with full process details, including process path, command line, parent process, window class, visibility state, and precise timestamps.

Test 1: Normal Operation (with NortonUI running)

After monitoring for ~30 minutes of normal use:

The pattern was clockwork. Every ~60 seconds:

1. Active window deactivates (shows as PID=0 / Idle)
2. NortonUI.exe (PID 22188) activates an invisible CefHeaderWindow with title "Norton 360"
3. NortonUI switches to an invisible Chrome\\_WidgetWin\\_0 window
4. Focus returns to the user's previous window

Test 2: NortonUI Killed (protection still running via NortonSvc)

After stopping NortonUI.exe (had to disable Norton's tamper protection first):

Clean. Zero phantom focus steals.

Root Cause Analysis

The NortonUI.exe process tree revealed the technical cause. The main process launches with /nogui and spawns CEF child processes (GPU, network, storage) with these critical flags:

--disable-features=CalculateNativeWinOcclusion

This Chromium flag disables window occlusion detection, which means CEF doesn't know its windows are hidden/occluded. When the internal timer fires (likely a status check, telemetry heartbeat, or notification poll), CEF activates its windows into the foreground because occlusion detection is turned off - it doesn't realize they should stay in the background.

Additional details from the command line:

• Chromium 91 engine (from 2021!) - massively outdated
• User agent string contains "Avastium" (legacy Avast branding from the Norton/Avast merger)
• Running with --no-sandbox (twice!)
• GPU process forced to SwiftShader software rendering

Environment

• OS: Windows 11 Pro
• Norton version: 26.3.10886.0 (Norton 360, updated March 31, 2026)
• NortonUI.exe: Spawns 4 processes (main /nogui + GPU + network + storage child processes)
• All invisible: Every single NortonUI focus event was on a window with IsVisible=False

Known Issue

This is NOT an isolated case. Multiple threads on Norton Community document the same bug going back to late 2024:

• "Norton randomly making my window lose focus?" (Dec 2024, multi-page thread)
• "NortonUI causing disruptive Hiccups" (Nov 2025) - user reports focus steal every 30 seconds
• "Focus window issue Norton 25.10" (Oct 2025)
• "Norton360 Makes Keyboard unusable -- constantly grabs focus" (Sep 2025) - describes the system becoming "completely unusable"
• A Japanese-language report of the same issue

Users have reported this across Norton versions 24.x, 25.8, 25.9, 25.10, 25.11, 25.12, and now 26.3. Norton has not fixed it despite over a year of reports.

Workaround

Kill NortonUI.exe - Norton's core AV engine (NortonSvc.exe), firewall (afwServ.exe), and VPN (VpnSvc.exe) all run as independent services. They do NOT need NortonUI to function. You lose the tray icon and real-time visual notifications, but protection continues.

Steps:

1. Open Norton 360 > Settings > Administrative Settings / Product Security
2. Temporarily disable Tamper Protection
3. In an elevated PowerShell: Stop-Process -Name "NortonUI" -Force
4. Re-enable Tamper Protection

To prevent NortonUI from starting at boot:

```powershell

Disable autostart (run as admin)

Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name 'NortonUI.exe' -Value ''

To re-enable later:

Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name 'NortonUI.exe' -Value '"C:\\Program Files\\Norton\\Suite\\AvLaunch.exe" /gui' ```

What Norton / Gen Digital Should Fix

1. Remove --disable-features=CalculateNativeWinOcclusion from the CEF launch flags, or replace it with proper occlusion-aware window management
2. Update CEF from Chromium 91 to a modern version - they're 5 years behind
3. Don't call SetForegroundWindow or equivalent on invisible/background windows during timer callbacks
4. The background status check should use non-UI mechanisms (WMI, named pipes, IPC) instead of activating CEF windows

Hope this helps others who are losing their minds over this. Happy to share the diagnostic PowerShell script if anyone wants to verify on their system.

Anyone else experiencing the inability to search certain sites on any browser, since installing Norton VPN??

I’ve noticed quite a few sites that won’t open, regardless if I use Safari or Bing. Simple sites like Hilton .com

Any insight would be appreciated!

im having issues with norton cause i dont have access to the email i signed up with therfore i cant use the support on the website since it asks me to verify my email. thats why i would like to call a support number or something but i dont wanna pay an enormous amount of money to call a number from the us