Behavioral Protection (IDP.HELU.PSE90) Blocking Legitimate Development Processes Despite Exclusions

[David_123]

Hello Norton Support,

I am experiencing a recurring issue with Norton 360’s Behavioral Protection (IDP). The product is repeatedly blocking legitimate development activity on my Windows system, even after I have added all possible exclusions for folders, files, and processes.

The detection is:

Threat Name: IDP.HELU.PSE90 – Command Line Detection Threat Type: Generic – Software that may damage data, the computer, or the network Status: Repaired Detected by: Behavioral Protection On PC since: 27/08/26 Last activity: 01/09/26 Startup Item: Yes Risk Level: High Community: Many users File: Deleted 5 days ago

Here are the activity details Norton reports:

Codice

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | Process | Interrupted
C:\Windows\System32\conhost.exe | Process | Interrupted
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | Process | Interrupted
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe | Process | Interrupted
C:\USERS\DAVID\APPDATA\LOCAL\TEMP\V3Z0UDHQ.DLL | File | Deleted
C:\USERS\DAVID\APPDATA\LOCAL\TEMP\__PSSCRIPTPOLICYTEST_OKYVOEHH.40L.PS1 | File | Deleted
2AA24E3837F221650166F8770C8CD3C0 | File | Deleted

The problem is that Norton continues to block these processes even after I have added exclusions for:

• PowerShell

• conhost.exe

• csc.exe

• cvtres.exe

• Temporary folders

• Application folders

Norton 360 does not provide the option to “Always Allow” this detection, so I cannot whitelist it. As a result, legitimate development tools cannot run on my system.

Could you please advise how to permanently allow or whitelist this specific Behavioral Protection detection (IDP.HELU.PSE90), or how to configure Norton so that these processes are not blocked?

Thank you in advance for your assistance.

Best regards, Davide

[bjm]

@David_123

Norton 360 does not provide the option to “Always Allow” this detection, so I cannot whitelist it. As a result, legitimate development tools cannot run on my system.

Could you please advise how to permanently allow or whitelist this specific Behavioral Protection detection (IDP.HELU.PSE90), or how to configure Norton so that these processes are not blocked?

Hello @David_123
Seems like when we have Behavioral Protection IDP threads.
Norton has to get involved.

May be best – to document/report “issue” directly via Norton support.
Note: for an official Norton response – open a support case:
Norton Support Help Center → Contact us (bottom of page)
Contact Norton Support → Let’s get started | Welcome (signed in)

++++++++++++++++++++++++++++++++++++++++

Lets ask AI

Norton 360 v26 Behavioral Protection engine operates independently of traditional file and folder exclusions, which is why it continues to aggressively block your development activity despite your current whitelisting efforts. The IDP.HELU.PSE90 detection string indicates a cloud-backed behavioral signature targeting automated command-line patterns.

When your development environment implicitly triggers powershell.exe to run memory-only scripts or compile short-lived components via .NET (csc.exe) in the Windows Temp directory, Norton’s real-time behavioral monitoring flags the sequence of actions rather than the static files. Because the temporary .ps1 and .dll payloads are randomly generated on the fly, static file paths or folder exceptions fail to catch them.

Since the v26 interface lacks an “Always Allow” toggle for this specific heuristic event, you can bypass this blocker using the methods detailed below, updated specifically for the v26 interface and its Ransomware Protection architecture.

---

Solution 1: Add Process Exclusions via the v26 Security Hub

To stop Norton from terminating the runtime behavior of your developer workflow, you must explicitly exclude the parent processes from Behavioral/Real-time monitoring, rather than standard Antivirus scans.

1. Open the Norton 360 v26 desktop dashboard.
2. On the left-hand navigation menu, click on the Security tab.
3. Find the Antivirus card/tile and click its Settings (gear icon).
4. Click on the Exclusions tab located along the menu options.
5. Click the Add Exclusion button.
6. From the type dropdown, change it from File/Folder to Process.
7. Input the absolute paths to the underlying binaries driving your compilation:

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

8. Click Save to apply the policy. (Note: Whitelisting system utilities like PowerShell instructs Norton’s real-time monitoring engine to ignore script injection patterns originating from them).

Solution 2: Exclude the Build Environment from v26 Ransomware Protection

The Ransomware Protection module (which replaces the legacy Data Protector component in v26) features an aggressive security layer that frequently overrides general exclusions when apps try to drop binaries into protected system spaces like AppData\Local\Temp.

1. Go back to the Security tab on the left menu.
2. Locate the Ransomware Protection tile and open its settings.
3. Find the section for Process Exceptions or Allowed Apps.
4. Rather than adding Windows system files, add the executable for your IDE or Build Tool (e.g., devenv.exe for Visual Studio, code.exe for VS Code, or your specific compiler runner).
5. Elevating your primary development app here permits the toolchain to freely drop temporary scripts and write files without triggering behavioral ransomware heuristics.

Solution 3: Submit a False Positive Dispute to Norton

If the behavior stems from a proprietary executable or a specific toolchain element you are building, Norton’s cloud engine will continue to signature-block it until its global threat telemetry is updated.

• Take the exact file hash listed in your detection report (2AA24E3837F221650166F8770C8CD3C0) and upload it to the Norton False Positive Submission Portal.
• Explicitly state that it is an IDP (Behavioral Protection) false positive affecting standard developer workflows (csc.exe and powershell.exe). Whitelisting cycles usually process within 24 to 48 hours.

Lets ask another AI

The alert IDP.HELU.PSE90 is triggered because your development environment is acting exactly like a piece of malware in real-time. It spins up PowerShell, launches the C# compiler (csc.exe), and drops a randomly named binary (V3Z0UDHQ.DLL) into your Temp folder.

In Norton v26, standard file and folder exclusions are completely ignored for this kind of activity. Instead, the engine looks at real-time behaviors across two modules: Ransomware Protection (formerly Data Protector) and Script Protection.

Here is the exact, step-by-step workflow to completely stop this loop in the v26 interface:

---

Step 1: Trust your IDE in Ransomware Protection

Because your compiler writes new binaries directly to your AppData\Local\Temp folder, the Ransomware Protection engine flags it as a ransomware staging event. To fix this, you must exclude the parent process (your IDE or build tool) so it becomes a “trusted creator.”

1. Open the main Norton v26 dashboard.
2. On the left navigation pane, click Security.
3. In the grid of feature tiles, locate Ransomware Protection and click to open its settings.
4. Look for the Processes or Program Exclusions section.
5. Click Add Process / Add Program.
6. Browse to and select the main executable file for your developer environment (for example: devenv.exe for Visual Studio, code.exe for VS Code, or rider64.exe).

Note: By doing this, Norton v26 will automatically trust any temporary .dll files or child processes that your IDE generates.

---

Step 2: Handle the “Block Malicious Scripts” Interception

Your log shows Norton blocking __PSSCRIPTPOLICYTEST_...ps1. This is a standard test Windows runs to check your PowerShell environment. Because it happens dynamically, Norton’s script shield flags it.

1. Go back to the main v26 Security tab.
2. Click on Advanced Security.
3. Locate the Web / Script Protection section.
4. Locate the Block Malicious Scripts toggle.
5. Turn this toggle Off.
6. Set the duration to Permanently (or Until System Restart if you want to test it right now).

---

Step 3: Clear the Main Antivirus Engine Block

To ensure the behavior block doesn’t bounce back under a generic detection, add your IDE binary to the core Antivirus rulebook.

1. From the main v26 dashboard, click Security.
2. Find the large Antivirus card and click Open.
3. Look at the very top of that sub-window and click the Exclusions tab.
4. Click Add Exclusion and select the same IDE executable you chose in Step 1.

Alternative Consideration for Developers
Consumer security software like Norton 360 v26 focuses heavily on aggressive behavioral analytics designed to block non-technical users from running bad scripts. For complex local development workflows, these automated cloud boundaries often result in constant disruption.

If these explicit exceptions fail to stick, consider turning off behavioral scanning during extensive code cycles, or transitioning to the native Microsoft Defender Antivirus which pairs natively with Windows Developer Mode to properly differentiate between normal development compilation and true malware behavior.

AI sourced content may make mistakes