Norton is investigating the issue. The Norton entries are legit entries to Norton services, that being said they should NOT be being written into the hosts file. I don’t personally think this is malware related but, Norton has to determine that. That is what Norton is investigating. The latest version 26.6.11052 (build 26.6.11052.988) is the version having the issues. Both Windows 10 and 11. When Norton has some answers they will post the response they want us to see. Nothing more we can do until then.
Thank you very much, in the meantime can you just help me understand what “the norton entries” are? Are these the gen-webserver.local and redirector.gen-webserver.local and how do we know they are norton entries?
The one Windows 11 machine that doesn’t have Norton installed does NOT have these entries in its hosts file. So yes, this is being written into hosts by Norton.
Edited: From a Norton support article this is what the standard host file should look like without and custom entries:
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# 127.0.0.1 localhost
# ::1 localhost
It was my understanding when the hosts file is changed it’s usually done via malware.
With the redirect of traffic through these address are we even safe? 1.2.3.4 is a real IP address.
127.0.0.1 gen-webserver.local www.gen-webserver.local # gen digital helper server
1.2.3.4 redirector.gen-webserver.local www.redirector.gen-webserver.local # gen digital helper server
This needs to fix fixed now as there is NO work around. This needs to be escalated and fixed Today. This is a terrible security flaw that is happening right now.
Kinda as a side effect to what’s been going on, I had to do a system restore on one of my computers recently. When I did it made Norton sluggish and choppy and whenever I tried to do scans or live update (it would lag as it scanned for updates), the local security authority process rose up in memory sometimes between 50MB-70MB. Is that unusual if you had a glitched Norton or has that been heard about. Since a reinstall of Norton, things went back to normal and it no longer caused the local security authority process to go up in ram.
The situation is neither dangerous nor problematic.
The hosts file is a Microsoft file that goes way back in time where a program going out to the internet would read the host file to get the numerical address of a spelled out website. For example, BankofAmerica.com would be resolved to something like 187.98.56.43 or whatever.
Todays modern browsers with enhanced protection bypass the hosts file completely and use Secure DNS from your ISP or other specified host like Google or Cloudflare etc. The hosts file is not relevant for those browsers as long as enhaced protection is engaged. Chrome, Edge, etc all follow this method.
So other programs needing internet access might read the hosts file. Indeed, those programs would be Norton 360 communicating to its web server and redirecting traffic back and for their own security purposes. This is why antivirus programs might install a few lines of code in the hosts file. It is a security protocol.
Now how these lines that have recently appeared seem to be from Norton 360 26.6.11052 (build 26.6.11052.988) is the mystery.
New lines of code in the hosts file from this latest version. Why Norton decided to do this is the mystery that we are waiting to hear about as @Soulasylum has pointed out many times. Yes they should come forward and make some announcement but in the meantime rest easy that no malware is at work redirecting your traffic to bogus sites and capturing your credentials.
@xjoex Respectfully, I disagree with the statement "The situation is neither dangerous nor problematic". The dangerous part is yet to be determined. ** Please read my latest post here for some clarification as we await Norton and their review.
The problematic issue from where I sit is data privacy. Everyone here SHOULD realize one thing if nothing else. The below domains are NOT accessible via a web browser.** No software that I have ever owned has written entries into my hosts file. Ever!! Others may have experienced a different scenario, which should be regarded as alarming at the very least. Windows itself, would NOT automatically alert the user that those entries were present and the hosts file had changed. Without a third party A/V solution installed Windows Defender most certainly WILL. In Windows Defender you can add exception per this info:
127.0.0.1 gen-webserver.local www.gen-webserver.local # gen digital helper server
1.2.3.4 redirector.gen-webserver.local www.redirector.gen-webserver.local # gen digital helper server
How to add an exclusion in Windows Defender:
Open Windows Security.
Go to Virus & threat protection.
Under Virus & threat protection settings, click Manage settings.
Scroll down to Exclusions and click Add or remove exclusions.
Click Add an exclusion, select File, and choose your hosts file (usually located at C:\Windows\System32\drivers\etc\hosts)
I had to uninstall Norton as it caused issues with my video stream for the OnVUE platform.
And yes, I tried to disable the webcam plus mic protection, then I disabled entirely the protection but no luck.
OnVUE was only saying that something blocked the video stream.
Fortunately, I was able to do a system test just before my exam and, as soon as I removed Norton, onVUE started to work again. Otherwise, I was surely losing my money and no exam.
I tried other well-known AVs (Kaspersky and ESET) and no issues whatsoever with onVUE.
Please fix the issue wherein nortonui.exe uses dedicated GPU. This drains the battery on laptops like crazy. Which clever person at Norton thought this change was necessary??
There is no need for an antivirus software to use dedicated GPU at all and that too constantly utilize it in the background even when the app is closed. Modern CPUs are powerful enough and sufficient to support functions like monitoring, scanning, etc. and basically do all antivirus tasks. It is not a modern AAA game that requires dedicated GPU all the time.
I hope some reasonable person at Norton is reading this and promises to fix this in the next update.
For those keeping track with the Norton hosts file
After today’s major update of Norton, this is added to the hosts file
127.0.0.1 revocation.gen-webserver.local www.revocation.gen-webserver.local # gen digital helper server
I would like to say, the scan on Norton did not signify this as malware.
So right now, here are the three lines
127.0.0.1 gen-webserver.local www.gen-webserver.local # gen digital helper server
1.2.3.4 redirector.gen-webserver.local www.redirector.gen-webserver.local # gen digital helper server
127.0.0.1 revocation.gen-webserver.local www.revocation.gen-webserver.local # gen digital helper server
These lines force your computer to route specific “Gen Digital” (Norton/Avast) web traffic internally. This is a built-in mechanism used by the software for local services, secure communication verification, and traffic redirection. It is not a virus or malicious. [1, 2, 3, 4]
Specifically, the entries do the following:
127.0.0.1 is your localhost (loopback), meaning it points directly to your own PC.
gen-webserver.local: Directs local traffic (e.g., from your Gen/Norton dashboard) back to your own machine.
redirector.gen-webserver.local: Points to a specific local proxy (1.2.3.4) used by the security software to manage or filter web traffic.
revocation.gen-webserver.local: Points back to your machine to intercept certificate or license checking. [1, 2, 3, 4, 5]
@xjoex Again and respectfully. This should not be put into hosts. Period. I cannot seem to drive that point home. You DO understand that web traffic redirection to Norton is a privacy issue?
Was downloading an update to one of my Steam games, on an Nvme drive, and it was taking forever and normally is only a couple minutes.
Noticed the drive was reporting 53% usage even after update was complete according to task manager, and the culprit was Norton!
It had somehow turned on the “optimize” feature by itself, and after looking in the windows control panel, system, defragment section, it was DEFRAGMENTING, NOT RE-TRIMMING, MY SSD!!
I immediately stopped it, went into norton, turned off the optimize feature.
I need to know how to permanently prevent norton from doing this, it WILL shorten the life of my drives, and is absolutely NOT needed for a high speed Nvme drive, I regularly trim my drives, NOT defrag, so this “feature’ of Norton’s is not needed or wanted and is going to damage drives.
Is there some kind of group policy setting in windows to completely block norton from behaving like this?
Norton overwrote existing valid entries in my hosts file without making a backup of the file, essentially deleting part of my network configuration. If I add them back, it will overwrite them again. How is that not problematic?
@Brian_XXX When you re-create your hosts file and put it back into the directory it belongs, set the file properties to “read only” and save the file. Reboot. Otherwise Norton WILL rewrite the entries back into hosts. There is another thread specifically about this issue here:
