@FrancisE_Neill Are you referring to the Windows Events Viewer? The system registry won’t log that sort of information. The Norton history will. Please clarify.
SA
The information I was referring to is ‘hidden’ away in Windows Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432\CLSID
There are thousands of entries in there and many seem to be every time my commuter connected to the internet and also when the VPN (Norton’s btw) connected..
I don’t understand it but was providing as much information as I could with the hope that someone could help me solve my Norton 360 problems. Norton’s History has very little information about VPN and network connections. I did a clean there but there was no where the information I have been describing contained in Norton’s History and clearing it has not solved any problem.
Even now Norton 360 always show ‘You’re Offline’, even though Live Update works, VPN installs normally and checking the VPN connection via Windows Control Panel show the VPN connection working perfectly.
I’ve removed → rebooted → reinstalled a few times, cleaned the registry, did a repair inside Norton. At the moment I have set logs active and will post the ID later or tomorrow.
And the 1101 Wireguard entries is what I’m trying to get rid of as I’m positive they are at the base of my problems. I cannot understand Norton’s logic to keep recording every VPN connection.
Trouble shooting data dump ID : BZKEW sent.
The registry location you referenced does have tons of entries there, on my machine as well. Nothing is there that is specific to Norton or any other software specifically. So what is the purpose of this registry area? Please review this Microsoft article for that information:
What is the COM model in this area:
So in essence the area defined is about how software talks to other software. Most of the common entries there are related to inprocsere32, what is this?
AI Overview
InprocServer32 is not antivirus software itself, but a core Windows registry key InprocServer32 that antivirus programs frequently interact with. [1, 2]
What it is:
It stands for “In-Process Server 32-bit.” It is a subkey in the Windows Registry InprocServer used by Windows to map specific system functions to Dynamic Link Libraries (DLLs) InprocServer32. [1, 2]How it relates to Antivirus:
AMSI Providers: Antivirus software registers itself as an AMSI (Antimalware Scan Interface) provider, often relying on
InprocServer32keys to hook into Windows processes and scan applications for threats
- Overwrites/Conflicts: Historically, enterprise antivirus products (like McAfee or Kaspersky) sometimes overwrite standard Windows
InprocServer32paths with their own script-scanning DLLs to monitor malicious code execution Policy VBScript execution failed with error codes OpC30-728 …, Internal Server Error" if a McAfee application changes vbscript ….- Malware Hijacking: Because these registry keys dictate which background processes run, hackers and malware often hijack
InprocServer32keys to force Windows to load malicious code alongside legitimate antivirus or Windows operations Detection: Malicious InProcServer32 Modification, Abusing the COM Registry Structure: CLSID, LocalServer32, & …. [1, 2, 3, 4]
If you are looking at an InprocServer32 entry in your registry, check the file path it points to. If it points to your antivirus installation folder (e.g., C:\Program Files\...), it is likely a legitimate plugin or scanner. If it points to a suspicious temp folder or a random location, it could be a threat
This area of the registry is NOT recording nor keeping a record of your VPN connections. Here is where your Norton VPN connections would be located:
AI Overview
Norton VPN does not generate specific “1101” error codes or entries in Windows. This error code usually points to a different application entirely, such as a Kyocera printer scanner issue or a Sonos network connection failure. If you are experiencing a Norton VPN issue on Windows, look for “Error 800” or check the built-in diagnostic tools. [1, 2, 3]
Because error codes and log entries for Norton Secure VPN rarely use the “1101” designation natively, you might be looking at one of these common scenarios: [1]
- You Mixed Up the Software
- Kyocera Scanner Error 1101: This commonly indicates an SMB/network scanning failure. It means your printer cannot communicate with your computer or find the correct network folder, usually due to your PC’s IP address changing or a firewall blocking the scan port.
- Sonos Error 1101: This typically means your speakers are temporarily unable to communicate with the update servers, requiring a router reboot. [1, 2, 3, 4]
- General Norton VPN Connection Issues (If you are having trouble connecting)
If Norton VPN itself is failing to connect or throwing an error:
- Firewall Interference: Your Windows Defender or Norton Firewall may be blocking the VPN’s connection attempt.
- Multiple Active VPNs: If you have more than one VPN program installed on your PC, they can conflict. Open Norton’s dashboard, go to Settings, and enable Enable multiple active VPNs to see if it resolves the issue.
- Reinstall the TAP Adapter: Norton uses a virtual network adapter. If this becomes corrupted, it can prevent the VPN from establishing a connection. Try a fresh uninstall and reinstall of your Norton 360 or Norton Secure VPN program. [1, 2, 3, 4]
How to Check the Correct Logs
If you want to view genuine Norton VPN entries in Windows, you should check the Norton History log rather than searching for random numeric error codes:
- Open your Norton app.
- Click on Security or My Norton.
- Select History or Recent Activity.
- Filter by VPN to view exactly what failed or succeeded.
(For a more detailed breakdown of what the VPN service is doing, you can also search Event Viewer on Windows and navigate to Applications and Services Logs > Norton).
Lets hope that Norton picks up your data dump and gives some straight forward reply about the issue.
***Note: I would also check your local hosts file to ensure it has not been tampered with.
SA
Thanks for all that. I’m still working my way through the information but it does help me to understand a few things though.
Note though that the 1101 total I keep publishing is not an error code but simply the consecutive number of times the VPN has connected to the internet. I cannot understand why Norton is recording and keeping the total count of VPN connections. It doesn’t keep track ot the number of times it connects to the internet normally. All my issues seem to start when it reached 1100, and then it added an extra 1 after I did a remove and reinstall. Now it stays at 1101.
Currently I have my N360 VPN enabled, started manually, not at boot time. I have only one instance of VPN WireGuard showing in Norton history. I also have WiFi security disable in the General tab of settings due to not using WiFi on this computer. Monitoring for a bit to see if anything like you are experiencing gets recorded in history.
SA
what is the new model_host.exe program in Norton and why does it run in the background in task manager. It’s connected to Norton, signed by Norton and located in the suite folder in Norton in Program files.
This is a background process that involves AI learning on the part of Norton. Below is the best information I can gather on the subject: NOTE- Are any of you seeing this issue running ANY AI based chat services on the affected devices? That can be the trigger for the issues being seen
AI Overview
The
model_host.exeprocess is a legitimate background program associated with recent updates to Norton 360. It runs as a part of Norton’s background engines, but some users have reported the process utilizing high amounts of GPU or battery. [1, 2]Key Details About
model_host.exe
- Purpose: It operates as a background host for Norton’s machine learning and AI-driven background tasks.
- Validity: While it originates from NortonLifeLock, sophisticated malware can disguise itself using the same name. To verify it’s legitimate, open the Windows Task Manager, right-click
model_host.exe, and select Open File Location. It should be housed in your Norton installation folder (typicallyC:\Program Files\Norton Security\...). [1]How to Manage or Troubleshoot the Process
Because it is a native background service, you cannot permanently delete the file without breaking Norton’s functionality. However, you can manage its impact: [1]
- Reduce Scan Resource Load: If
model_host.exeis consuming too much of your computer’s performance, open your Norton Device Security dashboard and change your scanning preferences to only run when the computer is idle.- Exclude Specific Files: If you believe the process is interfering with another application, use the Norton Exclusions Guide to add the process or specific folders to the scan exclusion list.
- Contact Support: If the program causes heating, battery drain, or severe system slowdowns, reach out to Norton Support to update your software version or troubleshoot the active processes.
- Latest topics - Norton Community
Table_content: | Topic | Replies | Activity | | — | — | — | | Tracking thread for Norton 25.9 / 25.10 / 25.11 / 25.12 releases
- Scan and Remove Malware | Malware Scanner Tool - Norton
Antivirus software like Norton 360 Standard helps protect against malware like viruses, spyware, and ransomware. And if malicious …
- Norton 360 NortonUI.exe Focus-Steal Bug - Reddit
Apr 5, 2026 — If you run this task just after killing NortonUI in PowerShell, nothing happens, but after a reboot, the same ‘Overseer’ runs for …
www.reddit.com·r/NortonAntiVirus
AI can make mistakes, so double-check responses
SA
No, no ai chat programs. It starts up seconds after signing into the computer after it boots and remains on
I currently do not have a PC that has an aftermarket GPU vice my gaming rigs to test on. I don’t allow Norton installations on those for due diligence of functionality and use Defender behind my local network and isolation. I have an older duster I use daily that has an ancient GT 730 4GB card installed, the process model_host.exe isn’t present in the Norton suite nor runs. I believe that is due to a device list check that searches the hardware on the device for a GPU that is capable of handling AI in one manner or another. This device isn’t meeting those minumums.
The Nvidia host software, and its settings for those of you who have more current GPU/CPU setups may be a larger part of the issue, with Norton checking for and finding compatible hardware then silently installing that process behind the scenes. This make clear sense to me for those reasons. I DO still have a brand new, unused tower having an RTX 3060 GPU w/12 GB memory that hasn’t been setup. That is my planned PC to replace my daily duster in the near future. Just wish I already had it running to validate my theory.
SA