I have a problem with Norton.

JamesSmith · 2026-07-15T03:55:31-0400

I have posted the issue on their support forums 24 hours ago and no one from Norton has acknowledged this issue which I think is quite serious.

If you read from here

Norton modify hosts file and says it’s malware

Okay so I want to clear a few things up. I believe this is a massive Norton security flaw. We can all restore the hosts file using the Microsoft support page. Great? No. As soon as you restart your computer Norton edits the hosts file to look like this adding 127.0.0.1 gen-webserver.local...

community.norton.com

My final post on the matter is here

Norton modify hosts file and says it’s malware

I agree with @SoulAsylum on this situation. I was successful in restoring my hosts file from a few days ago. Hopefully others can also find a way to restore their file. For those who are reading this for the first time. Do not restart your computer or run a Norton scan until we hear something...

community.norton.com

What do you all think? I made the right decision? I know you all have great experience with such matters. Yes I know Norton sucks and I should uninstall but yeah.

Admin please feel free to delete this if you believe it's not the right place for this.

Thanks.
James.

FreeBooter · 2026-07-15T04:51:27-0400

I don't think Norton modifying the Hosts file its malware infection doing so scan your computer with MalwareBytes.

idgat · 2026-07-15T05:25:39-0400

Agree with @FreeBooter. As much as I loathe the product, I can't see Norton responsible for this.

Source of purchase of Norton?

pseymour · 2026-07-15T08:07:03-0400

I don't see anything malicious here.

They're redirecting two domain names to the local machine (127.0.0.1), and two domain names to 1.2.3.4. The TLD for all four names is .local, which is reserved for local networking, that is, networks to which the host is connected. In other words, these DNS names aren't meant for use outside of the network the given host is connected to. It's not like it's redirecting microsoft.com, google.com, etc. to some malicious server.

By the way, 1.2.3.4 is a real IP address, but it belongs to APNIC and is used by their "Debogon" project. It's not malicious, nor is it intended to be used for any real traffic.

https://conference.apnic.net/29/pdf/dranse-1slash8.pdf

Norton is owned by Gen Digital, so the names themselves suggest this is being done by the Norton product, but again, .local domains are of no use in the outside Internet, so it's not like something malicious is trying to break your Norton either.

spapakons · 2026-07-15T08:19:57-0400

I haven't used Norton since 2006 because that version and newer made any computer crawl. I tried a couple of versions after 2006 but each one was even more resource draining. I haven't tried any modern version, I use Windows Defender and keep it updated.

gunrunnerjohn · 2026-07-15T12:19:08-0400

I dropped Norton a very long time ago as well. Norton and McAfee are trying to be all things to all people and succeeding at not doing anything well. They're mostly selling scare software, they try to convince you you're in mortal danger every time you boot up the machine.

Somehow, for the last 15 years of so, I've managed to live without either of them and I'm still on the planet.

spapakons · 2026-07-15T12:22:49-0400

Yes, they try to protect the computer but overdo it and it crawls all the time. Like having two or more antivirus active at the same time.

I remember McAfee being bundled with many laptops and when the trial version expires the owner just installs another antivirus without removing McAfee. And then he wonders why his new laptop is too slow.

JamesSmith · 2026-07-15T15:52:21-0400

The problem is the hosts file C:\Windows\System32\drivers\etc has default Microsoft code in it. Plus whatever code the user may have written.

As of 2 days ago when you restart your computer Norton adds its own code to that file. When you run a virus scan it flags that file as malware and if you clean the malware it deletes the hosts file. When you restart your computer it gets recreated with the code Norton added and none of the previous Microsoft code or any code that you have previously wrote.

They could have just edited the hosts file with their code and stopped there but they have completely deleted everything including peoples own rules for the hosts file. Oh and if you restore the hosts file then this continues to happen.

There is no fix or workaround except restore hosts file and never restart your computer or run any Norton services. Probably easier to just uninstall this piece of you know what.

I don't mind them doing this but I don't like how everything has been deleted. Their forums are a joke no one is even reading the posts.

spapakons · 2026-07-15T16:27:38-0400

You could keep a backup of the hosts file before you restart the computer but this is ridiculous. Get rid of Norton, unless you have too many months left of your subscription.

pseymour · 2026-07-15T16:38:52-0400

JamesSmith said:
The problem is the hosts file C:\Windows\System32\drivers\etc has default Microsoft code in it. Plus whatever code the user may have written.

Well, sort of. The default file has lines of text in it, but it's all comments. By default, Windows has no entries in the hosts file. But yes, if a user adds something and Norton overrides that, that's a problem. If Norton just appends to the user's entries, that's not really a problem. I saw what you said below this about this, so don't think I didn't, but I'm just blissfully unaware of what they're doing with whoever's content. If they're indeed deleting users' rules, bad.

JamesSmith said:
As of 2 days ago when you restart your computer Norton adds its own code to that file. When you run a virus scan it flags that file as malware and if you clean the malware it deletes the hosts file. When you restart your computer it gets recreated with the code Norton added and none of the previous Microsoft code or any code that you have previously wrote.

Yeah pretty annoying, but it sounds like a bug. They'll work it out or not, and each person will have to decide what they will tolerate. The lack of commentary from Norton is annoying.

Developers make mistakes too. I mean not me, but other developers do.

JamesSmith · 2026-07-15T16:59:12-0400

pseymour said:
Well, sort of. The default file has lines of text in it, but it's all comments. By default, Windows has no entries in the hosts file. But yes, if a user adds something and Norton overrides that, that's a problem. If Norton just appends to the user's entries, that's not really a problem. I saw what you said below this about this, so don't think I didn't, but I'm just blissfully unaware of what they're doing with whoever's content. If they're indeed deleting users' rules, bad.

Yeah pretty annoying, but it sounds like a bug. They'll work it out or not, and each person will have to decide what they will tolerate. The lack of commentary from Norton is annoying.

Developers make mistakes too. I mean not me, but other developers do.

I agree with you 100%.

Increasingly when Norton can't fix something they just say too bad and leave it up to the user to find a workaround. I have about 3 bugs which I have had to apply workarounds to. The most annoying one I had to fix was disabling NetBIOS over TCP/IP (IPV4) because there was a conflict with Norton.

If this isn't fixed in 2 weeks it's goodbye Norton. Luckily, I have Malwarebytes and HitmanPro.

Norton went from running silently in the background to now being a major headache and I know many people have deleted Norton in the past few years, I had hope. But I can't take anymore of this rubbish.

James.

neemobeer · 2026-07-15T17:10:12-0400

I can't speak for Norton directly, but the hosts file is a prime target for attackers to leverage to circumvent protections, exfiltrate data, and conduct other attacker based activity. It is very common for endpoint protection software to lock this file down and to treat modifications as malicious. With that being said most endpoint protection software will have a feature-based method to safely make modifications.

JamesSmith · 2026-07-15T17:27:09-0400

Just a quick question.

Am I safe to use RevoUninstaller to remove Norton considering the hosts file is being modified every time the computer restarts? If I delete using Revo will Norton 360 be gone prior to rebooting? I know there will be leftover files and registry entries to be removed after the reboot.

I guess I can just backup the hosts file so it really doesn't matter.

Thanks.

spapakons · 2026-07-15T17:43:57-0400

You have to disable all shields first. I expect Norton to resist uninstalling or modifying its files. Take a backup of the hosts file.

JamesSmith · 2026-07-15T17:53:15-0400

Another question for when I remove Norton 360

I have a paid version of Malwarebytes and it's configured to run in Windows security centre. Which means windows defender is off.

Do I leave malwarebytes on and leave defender off? Or do I stop malwarebytes running in the securty centre and turn windows defender on.

This is AI response

AI Overview

It is recommended to run both Windows Defender and Malwarebytes simultaneously for layered security. To do this without conflict, open Malwarebytes Settings > Security and turn off "Always register Malwarebytes in the Windows Security Center." This enables Windows Defender's real-time protection. [1, 2, 3]
Here is how the two programs work together:

Windows Defender (Microsoft Defender) acts as your primary, full-time antivirus to block viruses and secure your system.

Malwarebytes acts as a specialized second layer focusing on adware, malware, and behavioral threats that traditional antiviruses might occasionally miss. [1, 2, 3, 4, 5]

pseymour · 2026-07-15T18:02:22-0400

JamesSmith said:
Just a quick question.

Am I safe to use RevoUninstaller to remove Norton considering the hosts file is being modified every time the computer restarts? If I delete using Revo will Norton 360 be gone prior to rebooting? I know there will be leftover files and registry entries to be removed after the reboot.

I guess I can just backup the hosts file so it really doesn't matter.

Thanks.

I would follow their instructions, including running their removal tool. They say to run the tool "if the standard uninstall fails or shows errors," but I'd run the removal tool regardless. They would (presumably) know which registry entries and files need to be removed for their products. Hopefully. Then if you want to run a Revo-type thingy, sure, go ahead.

Uninstall your Norton device security product on Windows

Learn how to uninstall Norton security products from your computer. This article contains steps to uninstall Norton device security from Window 10, Windows 8, and Windows 7.

support.norton.com

As for running Malwarebytes and Defender, I believe @glasskuter does that. Paging Dr. @glasskuter...

neemobeer said:
I can't speak for Norton directly, but the hosts file is a prime target for attackers to leverage to circumvent protections, exfiltrate data, and conduct other attacker based activity. It is very common for endpoint protection software to lock this file down and to treat modifications as malicious. With that being said most endpoint protection software will have a feature-based method to safely make modifications.

Absolutely, but in this case, they're the ones putting entries in the hosts file. That's either a mistake, or they didn't account for those mods in their own maliciousness detections.

gunrunnerjohn · 2026-07-15T18:04:00-0400

JamesSmith said:
The problem is the hosts file C:\Windows\System32\drivers\etc has default Microsoft code in it. Plus whatever code the user may have written.

The "default code" in the unmodified HOSTS file is nothing but comments, there is no active lines in the file at all.

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

gunrunnerjohn · 2026-07-15T18:04:53-0400

pseymour said:
I would follow their instructions, including running their removal tool. They say to run the tool "if the standard uninstall fails or shows errors," but I'd run the removal tool regardless. They would (presumably) know which registry entries and files need to be removed for their products. Hopefully. Then if you want to run a Revo-type thingy, sure, go ahead.

Uninstall your Norton device security product on Windows

Learn how to uninstall Norton security products from your computer. This article contains steps to uninstall Norton device security from Window 10, Windows 8, and Windows 7.

support.norton.com

As for running Malwarebytes and Defender, I believe @glasskuter does that. Paging Dr. @glasskuter...

Absolutely, but in this case, they're the ones putting entries in the hosts file. That's either a mistake, or they didn't account for those mods in their own maliciousness detections.

I run Malwarebytes and Windows Defender, they have no issue coexisting.

pseymour · 2026-07-15T18:05:42-0400

gunrunnerjohn said:
I run Malwarebytes and Windows Defender, they have no issue coexisting.

That wasn't really in question.

JamesSmith · 2026-07-15T18:17:31-0400

gunrunnerjohn said:
I run Malwarebytes and Windows Defender, they have no issue coexisting.

Which one is your Antivirus? Defender or Malwarebytes?

I have a problem with Norton.

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers