Norton\Suite\ gui_resources\1.0.138-4

NAGYZOLTAN_DR · May 4, 2026, 12:03pm

Since the last 3 patches to My Norton360 delux
the app keeps downloading C:\Program Files\Norton\Suite\gui_resources\1.0.138-4

each time I start my windows 10 pc
frequently when running LiveUpdate
to be sure in 4 (four) different version of the same set of files
clear uninstall and fresh install did not help

No visible need or fault from having these files running the interface
Norton runs as intended (less fals flag update advertisments)
keeps my HD fragmented, boaring

26.4.10932 (build 26.4.10932.0)
installer version 26.4.10843.0

I sent 3 notifications to Norton to no avail.

bjm · May 4, 2026, 3:48pm

Hello @NAGYZOLTAN_DR
“3 notifications to Norton” – meaning you’ve documented/reported via Norton support?
Do you have an open Norton support case?

What you’re describing isn’t normal behavior—even for how frequently Norton 360 Deluxe updates its UI components. Those gui_resources\1.0.138-4 folders are part of Norton’s interface assets (basically skins, layouts, localized content). They do version and update separately from the core engine—but they’re not supposed to re-download on every boot or stack up repeatedly.

A few things are likely going on here:

What this usually means

Update state isn’t being recorded properly

Norton thinks the UI package didn’t install correctly, so it keeps retrying.

That’s why you’re seeing the same version (1.0.138-4) over and over.

Permission or locking issue

If something blocks Norton from finalizing or cleaning old versions (Windows permissions, AV conflict, or even indexing), it can’t “commit” the update.

Corrupt update cache

Even after reinstall, Norton sometimes reuses cached update metadata stored outside the main install directory.

LiveUpdate loop bug (not unheard of)

Occasionally a bad patch causes exactly this—repeated download/install of the same component.

Why your reinstall didn’t fix it

A standard uninstall/reinstall often doesn’t wipe everything. Norton leaves behind:

Update catalogs

Cached patch data

Some service-level configs

So the loop just resumes after reinstall.

What I’d try (in order)

1. Use the official removal tool (not just uninstall)

Run the Norton Remove and Reinstall Tool

Choose Advanced Options → Remove Only (not auto reinstall)

Reboot

Then reinstall fresh

This clears deeper remnants than Control Panel uninstall.

2. Check folder behavior
After a reboot:

Go to
C:\Program Files\Norton\Suite\gui_resources\

See if:

Multiple identical folders persist

Or they reappear immediately after LiveUpdate

If yes → confirms loop vs leftover junk.

3. Disable Fast Startup (Windows 10)
Windows sometimes resumes services in a weird cached state:

Control Panel → Power Options → Choose what power buttons do

Disable Fast Startup

This can stop “every boot = partial resume = update retry” loops.

4. Run LiveUpdate manually and watch it

Open Norton → run LiveUpdate repeatedly until it says fully up to date

Then reboot and see if it still downloads again

If it does → strong sign of a patch-level bug.

5. Check disk/permission quirks
Make sure:

You’re not running controlled folder access (Windows Defender feature)

No other AV/security tool is interfering

Folder isn’t read-only or locked

AI sourced content may make mistakes

NAGYZOLTAN_DR · May 5, 2026, 9:08am

THX for responding! I did the reinstall as you suggested (through Norton Remove and Reinstall Tool→ Remove Only). Moreover, I double checked in file explorer and made sure all files from Norton folders were gone (deleted some minimalistic leftovers). After a double restart I downloaded the installer from MyNorton profile. Installation went without problem. No updates were needed from LiveUpdate. Curious?

As I tried to say gui_resources\1.0.138- are downloading repeatedly in four different version folders such as 1.0.138-1, 1.0.138-2, 1.0.138-3, 1.0.138-4… looks like the very same files. I see what these html files are, and they do not cause ANY VISIBLE problems to the interface. Norton seems to work correctly, no faults otherwise.

I use “Norton” (or whatever the present Company has to do with it) for a good part of the last two decades. And, sorry, I would not mess with windows startup for the reason it never interfered with anything Norton so far.

Therefore, I presume this is a “Norton” glitch. I wanted to see if it is a common problem and may be waiting out for Norton correcting what it messed up with the new version. And, Thank You, I spend enough time already trying to rectify a support program on my aging Dell PC. My last resort to contact customer support that would refer me to “lets get started” page.

bjm · May 5, 2026, 10:49am

Hello @NAGYZOLTAN_DR

=============================================

May be best – for you – to document/report this issue directly via Norton support.
Norton support will likely request remote session – to see – as you see.
Note: for an official Norton support response – open a support case:

bjm · May 7, 2026, 10:29am

Hello @NAGYZOLTAN_DR
Care to share your progress

NAGYZOLTAN_DR · May 7, 2026, 11:49am

Detailed answer later. I had the last patch like a week ago (require restart). Live update at this very moment says My Norton is up to date. (AV module) is 26.4.10932 (build 26.4.10932.983), installer version 26.4.10843.0 and virus def. is 260507-0

Thank you for 4 version explanation. However, my symptom is the same:

one or all version keeps redownloading each time I start the PC
one or more versions downloading (probably with LiveUpdate) during the working session that I use my PC
it keeps fragmenting my PC HD (that is how I discovered the whole thing in the first place).
Otherwise, I see no faults in interface, or by running (regular) cleanups (like too many useless notifications), cloud backup, virus checks, etc.

Appreciate your efforts!

bjm · May 7, 2026, 12:22pm

Hello @NAGYZOLTAN_DR

May be best – for you – to document/report this issue directly via Norton support.
Norton support will likely request remote session – to see – as you see.
Note: for an official Norton support response – open a support case:

============================================

as test: call Norton LiveUpdate

SoulAsylum · May 7, 2026, 4:40pm

@NAGYZOLTAN_DR Have you ran live updates to get the latest version 26.4.10932 (build 26.4.10932.983) ? Rechecked to determine whether those files changed? Below is my listing after manually running LU a few moments ago:

SA

NAGYZOLTAN_DR · May 8, 2026, 10:05am

Today, now I can confirm…

with startup, “Norton” re-downloaded C:\Program Files\Norton\Suite\gui_resources\1.0.140**-1**
with LiveUpdate pushed MANUALLY it downloaded gui_resources\1.0.140-2, AND 1.0.140-4 (confirmed)
Norton qualified this download as a “program” update (good luck to find out what that means)
the last remaining missing one gui will be probably redownloaded during this session
nothing else “updated”

These are a total of couple of hundred (below 1001) small (mostly) html files in the folder of C:\…gui_resources\1.0.140-x… assets\illustrations dark and light themes, each two fragments

It takes a total of 20 minutes to defragment just this “glitch” on my machine…

boaring

Norton now joined the CLUB of and passed the bar of being a 1GB “support” app with (useless?) AI enabled “platform.” Why I am not surprised it creates self-inflicted glitches. I wonder if are any user benefit from these innovations? A lot of time wasted with figuring out. THX

bjm · May 8, 2026, 10:20am

Hello @NAGYZOLTAN_DR
Curious, are you drilling down each folder – examining asset organization in detail – possibly using: directory tree software – rather than ordinary casual browsing in File Explorer.

Maybe, you’re observing normal but messy-looking updater behavior through the lens of someone highly focused on HDD fragmentation and filesystem churn.

Maybe, your aging hardware has drawn your attention.
Maybe, your attention to details has found a gui_resources bug/glitch.

=============================================

fwiw ~

=============================================

Maybe — regional rollout, feature flags, subscription state, and UI/marketing configuration could influence which gui_resources revisions a user receives and when they receive them.

Maybe — W10 vs W11 could plausibly influence which gui_resources revisions are delivered and retained. Not necessarily because one OS has problems, but because Norton may be tailoring UI assets and rollout behavior by platform.

Norton’s GUI resource system appears heavily modularized and revision-driven, resulting in many small HTML/theme asset files and retained update folders. On HDD-based systems this can create noticeable file churn and fragmentation, even though it does not necessarily indicate a malfunction.

The structure and behavior of the gui_resources system does give an impression of something somewhat messy or over-engineered, even if it isn’t truly malfunctioning.

=============================================

Admitting… I’d known the folders existed and noticed version folders but had no reason to recursively inspect the asset structure…before reading @NAGYZOLTAN_DR posts.

Norton’s GUI resource system is probably more complex and noisier internally than most people realize, and a detail-oriented HDD-conscious user may be interpreting that complexity as evidence of glitches.

Maybe, your attention to details has found a gui_resources bug/glitch.

May be best – for you – to document/report this issue directly via Norton support.
Norton support will likely request remote session – to see – as you see.
Note: for an official Norton support response – open a support case:

bjm · May 9, 2026, 10:31am

Hello @NAGYZOLTAN_DR
fwiw ~ my machine – start of day

after Restart

after manual LiveUpdate

Yes — reviewing the sequence together, the progression actually tells a fairly coherent story.

Start of day

You had:

1.0.140

1.0.140-1

1.0.140-2

1.0.140-4

This suggests Norton began the day with a mixed/staged GUI resource state.

After Restart

You then got:

1.0.140

1.0.140-1

1.0.140-2

1.0.140-3

and -4 disappeared.

That looks like boot-time reconciliation:

Norton reevaluated resource manifests,

activated another fragment set,

rewrote resources.ini,

and normalized the package chain.

After Manual LiveUpdate

Then you got:

1.0.140

1.0.140-1

1.0.140-3

1.0.140-4

and -2 disappeared.

That strongly implies:

-2, -3, and -4 are not fixed permanent “install folders,”

but dynamic resource layers that Norton can swap in/out depending on update state.

What makes this especially interesting:
the base version never changed:

still 1.0.140

So this was not a traditional version upgrade.

Instead, Norton appears to be:

reassembling the same GUI release from interchangeable subpackages.

Honestly, your testing provides a better technical picture than the original Community post because you captured:

startup state,

reboot transition,

and LiveUpdate transition.

From a systems perspective, this now looks much more intentional than accidental.

The evidence points toward:

manifest-driven modular assets,

not uncontrolled duplication.

And importantly:
nothing in your screenshots suggests runaway accumulation.
The system appears to:

replace,

rotate,

or retire
resource fragments as state changes.

That is a very different scenario from:
“folders endlessly piling up forever.”

So I would summarize it this way:

The Norton Community poster correctly observed active GUI package churn.

But your machine demonstrates that this churn can occur during completely normal operation.

The behavior appears tied to Norton’s modern modular UI update architecture rather than necessarily indicating corruption or malfunction.

=============================================

Your captures showed something important:

the resource folders are not static

they are actively managed

their composition changes after:

startup,

reboot,

and manual LiveUpdate

Yet the overall GUI version remained:

1.0.140

That strongly supports the idea that Norton’s GUI resource subsystem is:

modular,

manifest-driven,

and internally dynamic.

So a technically observant user — especially one monitoring:

folder timestamps,

fragmentation,

file counts,

or LiveUpdate behavior —

could absolutely interpret this activity as:

“glitchy,”

“constantly rewriting,”

or “reinstalling itself.”

But your testing suggests the behavior itself may actually be normal.

What changed after your screenshots is that we now have direct evidence that:

Norton intentionally rotates resource fragments (-2, -3, -4)

during ordinary lifecycle events.

That makes the earlier observation more credible:
the GUI resource system is likely far more complicated internally than users assume.

Years ago, an antivirus UI might have consisted of:

static EXEs,

fixed DLLs,

bitmap resources.

Modern suites increasingly use:

HTML/CSS assets,

theme packages,

embedded web rendering,

modular UI bundles,

staged content delivery,

hot-swappable resource layers.

Which means:
a user inspecting the filesystem closely can see what looks like “constant churn,” even though the product is functioning normally.

The HDD-conscious user’s concern is still understandable because on a traditional spinning disk:

many tiny file writes,

asset replacement,

and manifest updates
can look messy from a fragmentation perspective.

But your screenshots suggest:
the churn itself is probably architectural behavior, not necessarily evidence of failure.

=============================================

Your machine showed:

controlled rotation among a small finite set:

-1

-2

-3

-4

with some folders disappearing as others appeared

and the base version staying constant at 1.0.140

That looks organized.

But if the Norton Community user were seeing something like:

1.0.140-1

1.0.140-2

1.0.140-3

1.0.140-4

1.0.140-5

1.0.140-6

1.0.140-7

continuing indefinitely over days/weeks without cleanup, then I would suspect:

failed package retirement,

broken manifest reconciliation,

stuck update transactions,

repeated self-repair loops,

or LiveUpdate failing to finalize state.

Especially concerning signs would be:

repeated downloads of the same resources every reboot,

continuously growing disk usage,

old folders never removed,

steadily increasing suffix numbers,

or constant timestamp churn with no stable resting state.

Your screenshots do not show that pattern.

Your system instead showed:

replacement/substitution behavior,

not accumulation behavior.

That distinction is important.

So I’d frame it this way:

Small rotating sets of GUI resource fragments = likely normal architecture.

Endless monotonically increasing suffix chains = likely abnormal behavior/glitch territory.

AI sourced content may make mistakes

NAGYZOLTAN_DR · May 10, 2026, 1:33pm

bjm GURU & Mr. maybe fwiw

Really helpful observations! Thank you!

A short note… I am sick and tired of large “platform” support apps updating 3 times a weak (but that’s not related to Norton). I have plenty of free space and my HDs are OK (one replaced recently). My “aging” Dell runs fairly well (on win 10, like many millions of users worldwide), but it does noticeably better after defragmentation. (My new win 11 compatible assembly is in the making). I was using Total Commander to compare folders (the number of files and size). Though I failed to notice the change in time stamps.

I still fail to grasp, what is MY benefit in modifying light and dark theme html files 3 times a day (also noticed in Live Update “Norton application update(s)” without any further details. For me the MOST important expectation from Norton is to protect my machine (and my bank account). Thank you.

bjm · May 10, 2026, 2:04pm

Hello @NAGYZOLTAN_DR

You’re likely monitoring Norton’s installed files — watching timestamps, file writes, or filesystem activity inside Norton’s UI/resource folders.

What you’re likely seeing is Norton repeatedly touching or updating:

cached UI resources

theme-related HTML/CSS/JS assets

Chromium/Electron-style interface components

localized interface bundles

telemetry/configuration state

browser-integrated UI elements

Modern security products — including Norton 360 — often use web-style UI frameworks internally. That means “theme html files” may not be static cosmetic files in the old sense. They can be part of:

dynamic rendering systems

cached resource packs

version synchronization

integrity verification

A/B UI deployments

cloud-delivered interface updates

So from the user’s perspective:

“Why are these files changing multiple times a day?”

…but from Norton’s perspective, the software may simply be:

refreshing cached assets

rewriting configuration manifests

updating timestamps/checksums

rotating temporary packaged resources

synchronizing UI modules after LiveUpdate/background tasks

Importantly, modification timestamps do not necessarily mean:

the visible theme changed

the user interface was redesigned

large amounts of data were rewritten

Sometimes only:

metadata

indexes

compressed package containers

cache manifests

are being updated.

The user’s frustration is understandable because:

older desktop applications changed files less often

HDD users notice disk activity more

monitoring tools can make routine background maintenance look dramatic

But the existence of repeated HTML/theme file writes alone is not strong evidence of malfunction or malicious behavior. Modern security suites are much more “live serviced” than traditional static desktop software.

Yes — that is very typical wording from modern Norton LiveUpdate.

Norton often gives only broad status text such as:

“Checking for updates”

“Downloading”

“Processing updates”

“Norton application update(s)”

…without exposing exactly:

which modules changed

what files were replaced

whether it was a hotfix, GUI resource update, engine update, or feature tweak

“Norton application update(s)” is basically Norton’s umbrella term for:

updates to the Norton program itself

as opposed to:

virus definitions

IPS definitions

reputation data

Safe Web data

browser reputation databases

It can include very small internal changes too, such as:

GUI resource packages

telemetry modules

update engine tweaks

browser extension communication changes

localized text/resources

service component refreshes

That’s one reason advanced users on forums sometimes become confused or suspicious — Norton no longer exposes the granular patch notes or file-by-file detail that older security suites sometimes showed.

In practice, if:

LiveUpdate completes successfully

no errors appear

Norton still opens normally

Security History is clean

…then “Norton application update(s)” by itself is generally just routine maintenance/update processing.

And yes, on HDD systems especially, even a vague “application update” can generate noticeable disk churn because Norton may:

unpack many small files

validate signatures

replace cached resources

rebuild internal indexes/databases

clean superseded update packages

without giving the user detailed visibility into the exact operations.

“Process Norton application updates” during Norton LiveUpdate usually means Norton has already downloaded update packages and is now applying/integrating them into the installed product.

That phase can include things like:

Replacing or updating Norton program files

Registering new components/services

Updating drivers or background modules

Applying configuration changes

Updating browser extension integration

Cleaning up old update files

Verifying signatures/integrity of the updates

Scheduling parts of the update for next reboot if needed

It is different from:

Checking for updates → contacting Norton servers

Downloading updates → retrieving files

Processing application updates → actually installing/committing the updates locally

With modern Norton products, this stage may also unpack cached update packages from:

ProgramData

temporary update folders

Engine / Definitions

GUI resource packages

That is why HDD activity can continue even after downloading appears finished.

A few normal behaviors during this phase:

brief CPU spikes

lots of small disk reads/writes

temporary UI pause

Norton tray icon activity

occasional request for restart

On older HDD systems, “Process Norton application updates” can sometimes seem slower because Norton products now contain:

many modular components

browser extension hooks

cloud/security telemetry modules

localization/UI resource packages

So the wording is broader than just “installing updates.” It is essentially Norton saying:

“We are integrating all downloaded product changes into the local installation.”

Usually in Norton LiveUpdate, “Up to date” means:

Norton has finished checking and/or processing updates, and there are currently no further pending updates.

That can happen in two different scenarios:

Nothing new was available

LiveUpdate checked Norton servers

no new updates existed

system was already current

OR

Updates were found, processed, installed

LiveUpdate downloaded updates

processed “Norton application update(s)”

completed installation/integration

now the system is current

So “Up to date” is really a final status condition, not proof that nothing happened.

That distinction is important because Norton’s UI is often very simplified now. Older security software sometimes explicitly showed:

“3 updates installed”

component names

version changes

patch notes

Modern Norton often compresses all that into:

“Processing updates…”
then

“Up to date”

So a user monitoring:

disk activity

modified files

timestamps

Total Commander comparisons

may correctly observe:

“something definitely changed”

even though the final UI simply says:

“Up to date.”

In other words:
“Up to date” means:

“No further action required right now.”

It does not necessarily mean:

“No files were modified during this session.”

“Why is Norton constantly rebuilding or modifying UI/theme resources when nothing visibly changed for me?”

That is a reasonable question from a power-user perspective.

The likely answer is:
the benefit is mostly for Norton’s internal servicing architecture, not for direct user-visible functionality.

Modern Norton builds behave more like continuously serviced platforms than old static Win32 applications. The UI layer may be:

modular

compressed into packages

regenerated from manifests

synchronized with cloud configs

refreshed after LiveUpdate checks

rebuilt for integrity validation

updated independently from the main executable

So the “light and dark theme html files” may actually function as:

packaged web-app resources

cached render layers

localized UI bundles

version-controlled assets

Chromium/WebView interface components

rather than simple hand-authored HTML files.

From the user’s standpoint:

there may be no visible benefit

the UI may look identical

the changes may seem wasteful

Especially on:

HDD systems

systems with filesystem monitoring

systems using comparison tools like Total Commander

…these maintenance writes become very noticeable.

The user is essentially observing a real trend in modern software design:

applications increasingly rewrite/cache/repackage assets frequently for internal lifecycle management even when the visible interface barely changes.

That does not automatically mean Norton is malfunctioning. It more likely reflects:

aggressive update modularization

cache rebuilding

asset packaging

integrity/version synchronization

cloud-connected servicing behavior

The user’s skepticism is understandable because older desktop software generally:

installed once

changed only during explicit updates

kept stable file structures for long periods

whereas modern security suites often behave more like evergreen web-connected platforms.

“Evergreen web-connected platform” is an informal way of describing modern software that is designed to be:

continuously updated

partially cloud-managed

modular

always evolving in the background

…rather than behaving like a traditional “install once and mostly stay static” desktop application.

A classic older Windows application might:

install from CD/download

rarely change files

only update when the user manually installs a new version

keep the same UI/resources for months or years

Modern software — especially security software like Norton 360 — often works very differently.

“Evergreen”
means:

the software is intended to stay continuously current automatically.

Examples:

silent updates

modular component refreshes

background feature rollouts

dynamic UI/resource replacement

cloud policy synchronization

The user may never see:

version installers

major upgrade prompts

traditional patch workflows

because updates happen incrementally all the time.

“Web-connected”
means:

the software architecture depends heavily on internet-connected services and web-style components.

That can include:

cloud reputation systems

telemetry/configuration syncing

remotely managed feature flags

HTML/CSS/JavaScript UI layers

Chromium/WebView rendering components

server-driven interface elements

So internally, the application may resemble:

a mini browser platform

a packaged web app

a continuously serviced client

more than a classic standalone desktop executable.

That is why users monitoring files may notice:

HTML files rewritten

cache directories changing

resource packages rebuilding

timestamps constantly updating

many small disk writes

even when the visible UI looks unchanged.

This behavior is common across modern software ecosystems, not just Norton:

browsers like Google Chrome and Mozilla Firefox

communication apps like Discord

game launchers

antivirus suites

cloud-sync utilities

Electron/WebView applications

All of these increasingly operate as continuously serviced platforms rather than static desktop programs.

So when the Norton Community user asks:

“What benefit do I get from modifying light/dark theme HTML files 3 times a day?”

…the practical answer may honestly be:

little or no directly visible benefit to the user.

The repeated modifications are more likely serving:

Norton’s update architecture

integrity/version management

cache/resource regeneration

cloud-connected servicing workflows

than delivering a noticeable front-end feature each time.

“Evergreen” is a legitimate software/IT term used by:

software engineers

browser developers

enterprise IT departments

security vendors

Microsoft/Google documentation

web developers

One of the most common uses is:

“evergreen browser”

meaning a browser that:

auto-updates itself

stays on the latest supported version

does not rely on users manually installing updates

For example, modern versions of:

Google Chrome

Microsoft Edge

Mozilla Firefox

are all considered evergreen browsers.

Enterprise IT documentation sometimes contrasts:

evergreen servicing
vs

long-term servicing/fixed-release models

You also see related terms like:

rolling release

continuous delivery

continuous deployment

evergreen servicing model

Security products increasingly follow that philosophy because threats evolve constantly, so vendors prefer:

small continuous updates
instead of

occasional giant version upgrades.

That is why modern security software may appear “busy” internally compared to older antivirus products from years ago.

AI sourced content may make mistakes

NAGYZOLTAN_DR · May 11, 2026, 2:18pm

Long story cut short: my system is OK, this is a new normal from Norton.

I am one of 100s of million users still on win 10 and using “obsolete” HDDs. You have to cook with what you’ve got…

I never had noticeable spikes from Norton (kudos), unlike other platform support apps over 1GB that have had to be kind of “killed” to know its place on my system (ordinary adobe reader or the Logitech mouse that roared).

Thank you again all for your efforts.

bjm · May 11, 2026, 2:24pm

Thanks for sharing your progress

bjm · May 14, 2026, 1:54pm

Norton\Suite\ gui_resources\1.0.138-4

Announcements