DISCLAIMER AT BOTTOM OF POST!
I have been troubleshooting a severe and completely reproducible issue involving Norton 360 on Windows 11 25H2.
This is not limited to one application, browser, networking component, or Windows utility. Installing Norton causes unrelated Windows processes and third-party applications to begin crashing. Removing Norton restores normal system stability.
System
Windows 11 Pro 25H2, build 26200.9168
AMD Ryzen 9 9950X3D
Gigabyte X870E AORUS Elite WiFi 7 Rev. 1.2
32 GB DDR5-6000 CL28
NVIDIA RTX 4080 Super
Samsung 9100 PRO system SSD
MSI Spatium M480 PRO secondary SSD
The system is otherwise stable. Microsoft Defender runs normally on this machine, and other security products have previously operated without producing this behavior.
System integrity checks including SFC and DISM were clean. WMI repository verification had also previously completed successfully outside the Norton-broken state. Obsolete third-party network/filter drivers were also removed during earlier troubleshooting.
After Norton is installed, unrelated processes begin failing. Examples seen during testing include Task Manager, Windows Search, System Settings, StartMenuExperienceHost, msinfo32, Opera GX, Chrome, Discord, TiWorker.exe, TextInputHost.exe, backgroundTaskHost.exe, mobsync.exe, and AppActions.exe.
Earlier Norton support minidumps showed the same exception across unrelated processes:
0xC0000005 / EXCEPTION_ACCESS_VIOLATION
Several historical dumps showed execution reaching addresses that were not inside any loaded module range.
One recurring Norton component present in crashing processes is:
C:\Program Files\Norton\Suite\aswhook.dll
I am not claiming that this alone proves aswhook.dll contains the defective instruction. A hook DLL can install trampolines or callbacks elsewhere in memory, so execution into an invalid unmapped address could still be consistent with a hook/trampoline failure.
I then reduced the reproduction to very small Microsoft command-line utilities.
While Norton was installed and the machine was in the failing state, I launched:
ipconfig.exe /all
route.exe print
arp.exe -a
netsh.exe winsock show catalog
whoami.exe
where.exe cmd.exe
driverquery.exe
fltmc.exe filters
Every one of these processes terminated with:
-1073741819
which corresponds to:
0xC0000005 / STATUS_ACCESS_VIOLATION
This is important because several of these utilities are not meaningfully related to Winsock or network traffic. whoami.exe, where.exe, driverquery.exe, and fltmc.exe all fail with the same access-violation status as ipconfig.exe, route.exe, arp.exe, and netsh.exe.
That makes a simple Winsock, firewall rule, or TCP/IP problem difficult to reconcile with the evidence.
At the same time, PowerShell queries against:
root/StandardCimv2:MSFT_NetAdapter
and
root/StandardCimv2:MSFT_NetAdapterBindingSettingData
fail with:
Microsoft.Management.Infrastructure.CimException
Server execution failed
HRESULT 0x80080005
The WMI Activity event log independently records those same provider failures.
Earlier WMI logging also showed the NetAdapterCim provider starting successfully in wmiprvse.exe before later queries began failing, which makes a missing or statically corrupt NetAdapterCim.dll less likely.
There is also a large amount of collateral DCOM timeout behavior while the system is in this state. My current interpretation is that the WMI/DCOM problems are probably secondary failures rather than necessarily the original trigger.
I also enumerated live loaded modules.
Norton’s aswhook.dll is broadly loaded into unrelated processes, including examples such as:
conhost.exe
powershell.exe
SearchFilterHost.exe
SearchProtocolHost.exe
svchost.exe
wscript.exe
audiodg.exe
Notepad.exe
PowerShell also had Norton modules including ArPotEx64.dll, aswAMSI.dll, and aswhook.dll loaded.
I then disabled Norton protection components one at a time while rerunning the same eight native Windows utilities.
Web Shield / Web Protection disabled: still 8/8 failures
Computer Protection disabled: still 8/8 failures
Smart Firewall disabled: still 8/8 failures
Behavior/intrusion-related protections disabled through the relevant categories: still failing
Remove Product Tamper Protection disabled: still 8/8 failures
Throughout these tests, aswhook.dll remained broadly loaded into unrelated Windows processes.
This suggests the behavior is not tied to any ordinary user-facing protection toggle.
I then tested Norton services.
Installed Norton services included:
nllbIDSAgent
Norton Antivirus
Norton Firewall
Norton Tools
NortonVpn
NortonWscReporter
Several core Norton services remained protected/non-stoppable even with Product Tamper Protection disabled, including Norton Antivirus, Norton Tools, nllbIDSAgent, and NortonWscReporter.
The Norton Firewall service was stoppable. I stopped it completely and reran the same native-process test.
Result: all eight utilities still failed with 0xC0000005.
That further weakens the theory that this is simply a Norton Firewall or Winsock problem.
My current working hypothesis is that an always-on Norton core process-instrumentation or hooking mechanism is involved. Something in that path may be establishing an invalid or stale callback/trampoline target, causing unrelated processes to execute into invalid memory and terminate with 0xC0000005. That in turn appears to cause secondary failures in COM/WMI and other Windows infrastructure.
This is still a hypothesis. What is confirmed is:
Norton installed → widespread reproducible failures
Norton removed → machine stable
Unrelated native Windows executables → same 0xC0000005
Firewall service stopped → no change
Normal protection categories disabled → no change
Tamper protection disabled → no change
aswhook.dll → still broadly present
I also attempted to capture a fresh full dump from whoami.exe using Windows Error Reporting LocalDumps.
LocalDumps was configured specifically for whoami.exe with DumpType 2 and a dedicated dump folder. Norton aswhook.dll on this system is version 26.8.11125.0 and is digitally signed by Gen Digital Inc.
SHA256:
0E44EB4DD0C0589622D8B500F3A4F33D73B176BF3F488A29389F83F547CD3F76
whoami.exe was then launched three times. All three attempts exited with -1073741819 / 0xC0000005.
Despite the targeted LocalDumps configuration, Windows Error Reporting created no dump at all.
That makes me suspect the crash may be occurring extremely early in process initialization or at a point where normal WER handling is not successfully completing.
At this point I would appreciate escalation to Norton engineering rather than further generic reinstall, SFC, DISM, Winsock reset, or Windows repair steps, because those avenues have already been extensively investigated.
DISCLAIMER I HAVE USED AI TO HELP ME WRITE THIS AS I AM TIRED AFTER DAYS OF TROUBLESHOOTING!