Getting spammed by "Threat Secured" popup window

[csilberg]

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract: Threat Secured message pops up multiple times a day even after closing the window

Detailed description: Ever since the new version of Norton 360 was released I am getting a Threat Secured message multiple times a day. There is no action required other than running a scan. This is just spam. Why is a product I paid for spamming me?

Product & version number:

OS details:

What is the error message you are seeing?

If you have any supporting screenshots, please add them:

[SoulAsylum]

Hello. This is not Norton spamming you, its telling you that you have an infection needing removal. It is resident on the computer in some manner. Have you cleared your system temp files? Open the run command and type in %temp%, press enter. Delete all the files found in the temp folder. If the threat still persists download Malwarebytes and run a full system scan to see what it detects.

Free Antivirus 2024 | Download Free Antivirus & Virus Scan | 100% Free...

SA

[bjm]

Is AIService a virus?
To check if a file is malicious or not, you need to open your Task Manager, right-click on the AIService.exe process and select Open file location. This will tell you its folder location. If the folder is named AIsoft or something to that effect, it could be malicious. Next right-click and select properties. Check under the Details tab. What do you see? Is it related to a program you have installed? Or not?

There are reports that AIService.exe is a type of Coin Miner malware that mines cryptocurrencies by using the hardware of the affected computer. But one cannot just jump to conclusions. Once you have done the preliminary examination, you will get an idea. If you suspect that the AIService.exe running on your computer might be malicious, remove it quickly, as it can be very dangerous and can harm your PC.

source is ad supported

What is AIService.exe?
This process often attracts people’s attention with its spike in CPU and memory usage, making users’ PCs slower or stuck. That’s weird and you may need to resolve the AIService.exe high CPU usage as soon as possible before something severe happens.

AIService.exe, also AI Service, is one kind of Trojan Coin Miner. The virus can infiltrate your system via software bundling, intrusive advertisements, malicious unknown sites, etc.

As you can see, this AIService.exe virus will trigger damage to your system. After eating up your CPU and memory, many system errors can occur and the whole PC performance will be jeopardized, let alone system crashes or data loss.

Besides, the AIService.exe virus, controlled by hackers, is commonly exploited for fraud and theft of various sensitive data. With the help of AI Service providing unauthorized access to the computer, hackers can establish remote control over the entire system. That’s dangerous.

source is ad supported

=============================================

How to install and run a scan with Malwarebytes [here]

Were my machine and I wanted reassurance.
I’d ask Malwarebytes Malware Removal Help Forums [here] to check my machine.

[MTZ8591]

I am also receiving these annoying “Threat Secured” pop ups numerous times a day and they all seem to be related to the Wall Street Journal. I can’t believe that wsj.com is tracking me in a malicious way. How do I stop these pop ups that appear to relate to only one website?

[bjm]

@MTZ8591

I am also receiving these annoying “Threat Secured” pop ups numerous times a day and they all seem to be related to the Wall Street Journal. I can’t believe that http://wsj.com is tracking me in a malicious way. How do I stop these pop ups that appear to relate to only one website?

Hello @MTZ8591
popup details also AIService.exe or Threat secured with different threats?
OS Details:
browser? version#?
browser extensions?

are you signed in at wsj?
did you try adding Browser Protection → Exclusion → https://www.wsj.com/…as test

btw ~ I’m not seeing Threat secured on wsj.com (default Edge profile - no extensions)
Note: I’m not signed in on wsj.com

supporting screenshot: ?

[Thomasvan_Offeren]

I’ve the same. Getting spammed multiple times a day. I guess this is a true positive alert. But I dont know what to do next. I did scan the pc, did a reboot.

[SoulAsylum]

All: Visited wsj website on Opera GX without any issues or alerts. Screenshot does show wsj.com is tracking those who visit whether logged in or not logged in.

SA

[bjm]

@Thomasvan_Offeren

I’ve the same. Getting spammed multiple times a day. I guess this is a true positive alert. But I don’t know what to do next. I did scan the pc, did a reboot.

the same?
https://www.wsj.com/
are you signed in on wsj.com

browser? version#?
browser extensions?

Issue:
Detailed description:
Product & version number:
OS details:
Error message:
Supporting screenshots: Show details

Note: Do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

[Reh1962]

I cannot tell what is causing the incessant notices that Norton has “prevented a connection to cloudincome.com” and blocked it. How do I find out what is trying to connect to that? I’ve never gone there before. I tried removing temp files, installed and ran Malwarebytes, and nothing was stopped or revealed. Does Norton ever read these and/or do anything about this stuff? Thanks.

[bjm]

@Reh1962

I cannot tell what is causing the incessant notices that Norton has “prevented a connection to cloudincome.com” and blocked it. How do I find out what is trying to connect to that? I’ve never gone there before.

Hello @Reh1962
Did you clear browser cookies n cache?
Do you run browser sync?
Did you recently install any program / browser extension?
Did you recently allow push notifications?
Did you recently change site permissions?

• Please post supporting screenshots: Show details

Note: Do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

@Reh1962

How do I find out what is trying to connect to that? I’ve never gone there before.
I tried removing temp files, installed and ran Malwarebytes, and nothing was stopped or revealed.
Does Norton ever read these and/or do anything about this stuff?

Norton Community is primarily user-to-user product help.

Were my machine and I wanted reassurance.
I’d ask Malwarebytes Malware Removal Help Forums [here] to check my machine.

==============================================

False Positive and False Negative Submissions Portal [here]

[bjm]

@Reh1962

I cannot tell what is causing the incessant notices that Norton has “prevented a connection to cloudincome.com” and blocked it. How do I find out what is trying to connect to that? I’ve never gone there before.

Hello @Reh1962

003ab2b7e2ec/2024-12-31T17:34:04.666Z

False Positive and False Negative Submissions Portal [here]

We received your submission and we will review it within the next 48 business hours. We will update our detection database once the result of the technical analysis is ready.

[bjm]

@Reh1962

I cannot tell what is causing the incessant notices that Norton has “prevented a connection to cloudincome.com” and blocked it. How do I find out what is trying to connect to that? I’ve never gone there before. I tried removing temp files, installed and ran Malwarebytes, and nothing was stopped or revealed.

Hello @Reh1962

e0abad595b4c/2024-12-31T17:48:55.980Z

• Learn more about Safe Web here

cloudincome.com resolves to 194.1.147.23
94.1.147.23 IP Address Information
ISP K Media Tech Ltd.
Usage Type Data Center/Web Hosting/Transit
Hostname wpx.net
Domain Name wpx.net
Country United Kingdom of Great Britain and Northern Ireland
City Manchester, England

====================================

fwiw ~ this process [here] works for me to reach:
Norton support via Social Support | Chat | Phone [here]

How to Use Norton Live Online Chat 2024 [here]

[Dennis_Ogden]

I am getting these every day. They are associated with incoming spam email, which I get a lot of.
Can I disable the pop ups? The method shown above did not fix it, unless “on” means I want to get the pop ups.

[bjm]

@Dennis_Ogden

I am getting these every day.

You’re also getting "We prevented a connection to cloudincome.com” because…?

Product & version number:
OS details:
error message:
supporting screenshots:

76eca0f29529/2025-02-17T23:31:47.622Z

Learn more about Safe Web [here]
False Positive and False Negative Submissions Portal [here]

We received your submission and we will review it within the next 48 business hours.

@Dennis_Ogden

Can I disable the pop ups?

have you tried adding an exclusion? … if you disagree with Norton

[Dennis_Ogden]

I’d add a picture but it errors out. Its a new one for each email so excluding a site is useless.

[bjm]

@Dennis_Ogden

I’d add a picture but it errors out. Its a new one for each email so excluding a site is useless.

Do you run browser sync?
Did you recently install any program / browser extension?
Did you recently allow push notifications?
Did you recently change site permissions?
Did you reset browser?
Did you run Norton Full Scan?
Did you run Malwarebytes Scan?

How to install and run a scan with Malwarebytes [here]

Were my machine and I wanted reassurance.
I’d ask Malwarebytes Malware Removal Help Forums [here] to check my machine.

[bjm]

@Dennis_Ogden

I’d add a picture but it errors out. Its a new one for each email so excluding a site is useless.

Please try uploading image to https://postimages.org/
Please try copy Direct link: and paste (space characters to break link) with your message.

for example:

https: //i. postimg. cc/FRDnZ2Zr/png-20065. png

---

or try Preformatted text </> to break link
https://i.postimg.cc/FRDnZ2Zr/png-20065.png

Product & version number:
OS details:
Error message:
Supporting screenshots: Show details
Security History: related events

Note: Do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

[Dennis_Ogden]

https ://i.postimg.cc /KvCWx3GZ/popup.jpg
This is a sample, each one references a different email.

[Dennis_Ogden]

And nothing has changed. It has the button to “scan PC” but no problem found.
To reiterate, the messages show up when I get a batch of email in.

[bjm]

@Dennis_Ogden

https ://i.postimg.cc /KvCWx3GZ/popup.jpg

Um, who/what is sending these emails?
are emails from “marketbeat.com” <partners@analystratings.net>
see here

maybe, See details…helps? 1 / 7 detections?