Norton Behavioral Protection blocks PowerShell during Windows Update – IDP.HELU.PS.CmdSvc1 and update/restart failures

[DustMystery]

Issue abstract:
Norton 360 Behavioral Protection detected IDP.HELU.PS.CmdSvc1 - Command line detection during a Windows Update operation. Norton terminated legitimate Windows processes including cmd.exe, powershell.exe, and conhost.exe, and deleted a temporary PowerShell __PSScriptPolicyTest_*.ps1 file.

While Norton protection was active, Windows Update repeatedly showed Restart required, and restarting the PC multiple times did not complete the updates. After I temporarily stopped Norton protection and restarted Windows, the pending Windows Update completed successfully.

I would like Norton to confirm whether this detection is a false positive and whether it has been fixed in the latest Norton 360 26.9 release.

Detailed description:
On September 12, 2026, while Windows Update was installing September Windows updates, Norton Behavioral Protection generated the following detection:

IDP.HELU.PS.CmdSvc1 - Command line detection

Norton reported the threat as repaired and performed the following actions:

• C:\Windows\System32\cmd.exe — Process — Terminated

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe — Process — Terminated

• C:\Windows\System32\conhost.exe — Process — Terminated

• C:\WINDOWS\SYSTEMTEMP\__PSSCRIPTPOLICYTEST_B0JA4GGU.EYK.PS1 — File — Deleted

• 8E7BC7E00798C6F66A0411D2AEAEAE2E — File — Deleted

• 5105C98F01E0EED70AC3B58CF9E14CCE — File — Deleted

Norton showed:

• Detected by: Behavioral Protection

• Status: Repaired

• Startup Item: Yes

• On PC from: 9/12/2026 8:00 AM

• Last Used: 9/12/2026 9:07 AM

At the same time, Windows Update repeatedly showed updates as Pending restart. I restarted Windows several times, but the updates would not finish.

I then temporarily stopped Norton protection and restarted the computer again. The Windows Update immediately completed successfully after Norton was stopped.

This makes me suspect that Norton’s Behavioral Protection was interfering with a legitimate Windows Update/PowerShell servicing operation.

Later, I also experienced Windows servicing problems, including:

• Windows Update failure: 0x80070424

• TrustedInstaller / Windows Modules Installer service registration was missing

• sfc /scannow initially reported:
  Windows Resource Protection could not start the repair service.

• After restoring the TrustedInstaller service, SFC was able to run but reported corrupt files it could not repair.

• DISM /Online /Cleanup-Image /ScanHealth reported:
  The component store is repairable.

• DISM /Online /Cleanup-Image /RestoreHealth failed with:
  0x800f0915 - The repair content could not be found anywhere.

• A Windows 11 in-place repair installation also failed with:
  0x8007001F - 0x20006
The installation failed in the SAFE_OS phase with an error during REPLICATE_OC operation.

I cannot confirm that Norton caused these later servicing problems, so I am not claiming that it did. However, the original Windows Update restart problem was reproducible in the sense that it remained stuck while Norton protection was active and completed after Norton was stopped.

Product & version number:
Norton 360

Current version:

• Program version (AV module): 26.9.11171 (build 26.9.11171.0)

• Installer version: 26.9.11503.0

• Virus definitions version: 260916-6

• UI version: 1.0.152

The original IDP.HELU.PS.CmdSvc1 incident occurred before I updated to this latest Norton version.

OS details:
Windows 11 25H2, 64-bit
OS build at the time of the later servicing investigation: 26200.9457

Relevant Windows update:

2026-09 Security Update (KB5129195) (26200.9457)

What is the error message you are seeing?

Norton detection:

IDP.HELU.PS.CmdSvc1 - Command line detection

Windows Update:

0x80070424

DISM:

Error: 0x800f0915
The repair content could not be found anywhere.

Windows 11 Setup:

0x8007001F - 0x20006
The installation failed in the SAFE_OS phase with an error during REPLICATE_OC operation.

Questions for Norton:

1. Is IDP.HELU.PS.CmdSvc1 detecting the Windows-generated __PSScriptPolicyTest_*.ps1 file a known false positive?

2. Why did Behavioral Protection terminate Microsoft’s cmd.exe, powershell.exe, and conhost.exe during this operation?

3. Has this specific detection been corrected in Norton 360 26.9.11171 or through updated behavioral/virus definitions?

4. Is there a safe way to prevent Norton from interfering with legitimate Windows Update servicing without excluding powershell.exe, cmd.exe, or the entire C:\Windows\SystemTemp directory?

5. Are there Norton logs I can provide that would allow the Norton team to identify the exact command line that triggered IDP.HELU.PS.CmdSvc1?

Supporting screenshots:
I will attach screenshots showing:

• Norton IDP.HELU.PS.CmdSvc1 detection details

• Norton Activity page showing terminated processes and deleted files

• Windows Update pending restart/failure information

• Current Norton 360 version information

  

[bjm]

@DustMystery

Norton 360 Behavioral Protection detected IDP.HELU.PS.CmdSvc1 - Command line detection during a Windows Update operation. Norton terminated legitimate Windows processes including cmd.exe, powershell.exe, and conhost.exe, and deleted a temporary PowerShell __PSScriptPolicyTest_*.ps1 file.

Hello @DustMystery

May be best – to document/report “issue” directly via Norton support.
Note: for an official Norton response – open a support case:
Norton Support Help Center → Contact us (bottom of page)
Contact Norton Support → Let’s get started | Welcome (signed in)

Send Norton product debug logs with Norton Support Tool

Maybe, try Troubleshooting → Record a performance issue &or Enable/Send debug logs

[DustMystery]

i have tried to find a way to report the bug, and the chat bot can not report a bug or help with it,
the last resort i reached is to call by phone to support,
its strange there is no place to report a bug
This forum should be the place for these cases also

[bjm]

@DustMystery

and the chat bot can not report a bug or help with it,

How to Bypass Norton Chat Bot
When launching the online chat, the automated assistant will try to diagnose your issue. To break through the menu:

• Type the word “agent” three times and press send (“agent” send | “agent” send | “agent” send)
• Alternatively, typing “live agent” or “human” will also trigger the system to transfer you to a real support representative.

How to Bypass Norton Phone Bot
When calling Norton support, the voice recognition system will ask you to describe your problem. To skip the prompts:

• Clearly speak the word “agent” three times into your phone when the automated voice finishes speaking.
• If the system asks you to clarify your issue, ignore the options and continue repeating “representative” or “operator.”

By repeatedly signaling that you want human assistance, the system’s algorithm will automatically route your session or call to the next available live agent.

Note: type/speak “agent” three times works for me

Please confirm you’re allowing Norton pages content in order to provide the best experience possible.
Please confirm you’re allowing Norton ads, cookies, trackers, analytics, scripts, beacons, etc., etc.,
Please whitelist norton.com, login.norton.com, my.norton.com, nortonlifelock.com, support.norton.com, buy.norton.com, renew.norton.com
Please disable VPN…Ads blocker…try from Norton Private Browser

Please see us.norton.com General Privacy Notice and Cookie Statement for additional information.

[bjm]

@DustMystery

i have tried to find a way to report the bug, and the chat bot can not report a bug or help with it,
the last resort i reached is to call by phone to support,
its strange there is no place to report a bug
This forum should be the place for these cases also

Hello @DustMystery

PSScriptPolicyTest_*.ps1 and .psm1 files are legitimate temporary scripts dynamically generated by Microsoft Windows PowerShell. Whenever a PowerShell process initializes or checks modern security profiles, it creates these files in the Temp directory to check which AppLocker or Language Mode rules are applied to the operating system.

Norton’s Behavioral Protection operates via a “kill chain” mitigation model. When a background script triggers a severe threshold rule, the behavior engine does not just look at the script file itself; it aggressively traces the process tree.

• powershell.exe was terminated because it was the process spinning up the script file.
• cmd.exe and conhost.exe were terminated because they were either parent processes orchestrating the update execution or essential terminal subsystems housing the active threads.

Once a trigger is flagged as a high-risk malicious action, the behavioral logic overrides system defaults and terminates all associated components to contain what it believes is an active threat.

Because heuristic algorithms are dynamic, false positives around unique alphanumeric command configurations (like the string variations matching IDP.HELU.PS.CmdSvc1) are routinely updated through cloud and database streaming definitions rather than requiring entirely new client builds.

If this incident took place during the mid-September update push and you successfully updated your Virus definitions version past that timeframe, the underlying behavior signature has likely been adjusted.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

May be best – to document/report “issue” directly via Norton support.
Note: for an official Norton response – open a support case:
Norton Support Help Center → Contact us (bottom of page)
Contact Norton Support → Let’s get started | Welcome (signed in)
How To Bypass Norton Bot

Tell the agent: “I need to escalate a False Positive Behavioral Detection (IDP.HELU.PS.CmdSvc1) that disrupted a Windows Update.”
Copy and paste the exact text from your original message showing what was Terminated and Deleted. This will let them immediately bypass standard troubleshooting scripts and escalate the ticket directly to their Tier 2 or Security Response engineering teams.

AI sourced content may make mistakes

[DustMystery]

Thank you, i’m chatting with the agent and he is reading this topic

[bjm]

@DustMystery

I’m chatting with the agent and he is reading this topic

Thanks for sharing your progress

[DustMystery]

welcome

[bjm]

Hello @DustMystery
Care to share your progress

[DustMystery]

Hello,
an employee contacted to enable debug mode and send the logs,
i will enable debug mode before the next windows update on 2026-10-13,
if update failed again i will send the logs,
currenlty i have repaired my windows after the damage from the update blocked by the antivirus behavior detection

[bjm]

@DustMystery

an employee contacted to enable debug mode and send the logs,
i will enable debug mode before the next windows update on 2026-10-13,
if update failed again i will send the logs,
currenlty i have repaired my windows after the damage from the update blocked by the antivirus behavior detection

Thanks for sharing your progress