Thanks for the feedback/explanation. I’ll then use that Support Tool you have linked as well.
Ted
1 Like
This has gotten to the point where my computer is no longer functional. I have created a tech support ticket with Norton (xxxxxxxxx) and Norton attempted to call me back on Sunday afternoon. Of course with this being a holiday weekend I wasn’t around. I hope they call back today. I have disabled both the auto-protect and smart firewall but that no longer prevents Norton from peaking out my GPU. As soon as I watch a youtube video the GPU pegs. It is getting to a point where I may have to uninstall Norton if they don’t call back with a resolution soon.
Well, there was a big Norton update today, and i hoped they fixed the issue. Unfortunately its still there, and besides NortonUI.exe running on the GPU, Norton added a SECOND process called “model_host.exe”, located in the Norton/Suite installation folder, to run on the NVIDIA GPU. It’s getting even worse now.
1 Like
@ARP Did you just perform a clean reinstall and updated to 26.5.10994 (build 26.5.10994.0) ? I haven’t had an installation folder on my systems for a very long time. The file model_host.exe is found within my installs.
SA
@SoulAsylum with installation folder i ment the folder where Norton is installed. In my case C:\Program Files\Norton. I didnt reinstall this time, i just updated by using the Norton liveupdate. I’m sorry for the miscommunication. The file mode_host.exe is there for me as well.
Just to add, I did try a complete clean reinstall of Norton after using its removal tool as well as a clean NVIDIA driver remove and reinstall. That didnt fix it though. I saw some posts on Reddit as well regarding this issue, and apparantly there is some sort of fix to brute-force NortonUI.exe to shut down by disabling tamper-protection and using Windows Powershell as administrator. I did not try that yet though.
Thank you for the post back. Another question is do you have Life lock services running with your Norton subscription install? I currently DO NOT have Life Lock and, the file model_host.exe is not on any of my Windows 10 or 11 machines. Here is my reasoning for asking:
AI Overview: Note - I believe this is in some ways inaccurate as the current install file structure is different from what this AI information presents. The usage of the file is what I was aiming for overall.
model_host.exeis a legitimate executable file associated with Norton LifeLock software. It primarily runs background machine learning (ML) processes and specific heuristics for Norton’s Exploit and Threat Prevention.What is
model_host.exe?
- Function: It processes artificial intelligence-based behavioral analysis to detect zero-day exploits, emerging malware, and malicious file anomalies.
- Location: It is normally located in a subfolder of your main Norton installation, usually:
C:\Program Files\Norton Security\Engine\[Version Number]- Resource Usage: Because it powers machine learning models, it may temporarily cause high CPU or memory usage while performing deep heuristic scans. [1, 2]
Is it Safe?
Yes, the official
model_host.exesigned by NortonLifeLock Inc. is safe. However, malware can sometimes disguise itself by using the same name.How to Verify the File’s Authenticity
- Open Task Manager (Ctrl + Shift + Esc).
- Right-click on model_host.exe and select Properties.
- Go to the Digital Signatures tab.
- Ensure the signature is verified and belongs to NortonLifeLock Inc.
Troubleshooting High Resource Usage
If
model_host.exeis slowing down your PC:
- Wait for it to finish: It usually runs during system idle times or after an update to map your files.
- Scan your PC: Run a full system scan using the Norton device security interface to rule out any malicious modifications.
- Perform a Reinstall: If it crashes frequently or continually causes severe freezing, use the Norton Remove and Reinstall tool to refresh your installation.
SA
I just have Norton 360 installed. I dont use any other Norton programs like utilities or anti-tracking or whatever they are showing with all the popups and smart-scan results. Unless lifelock is included in 360 I dont have it.
Hey all,
Tracking this thread. Just did a norton liveupdate 5/29/26. Still nortonui.exe is running on the NVIDIA GPU. Bummer. Have deepfake turned off. Have tried everything on this thread. Was hoping this update would fix it.
Disabling and re-enabling the NVIDIA display adapter in Device Manager stops nortonui.exe running on GPU untill laptop restarts. I’m using this workaround until they fix it. My system Win11 Razer Blade 18 (2023) with RTX 4080.
2 Likes
This works! Not ideal but the best solution so far 
Jeg har lige snakket med norton efter jeg smed det på er de ved at se på fejlen som hotfix 
Plus 2 mere til norton utilities
Det er 7 på som hotfix i den her uge af mig
1 Like
For all the NVIDIA GPU users in the thread, is your driver installation 569.49 or a version before? If you have an earlier version updating is suggested. Version 569.49 fixes vulnerabilities listed in CVE-2026-24187. For both Linux and Windows. Get the latest for your specific GPU model and OS.
On my Windows 11 machines I do NOT see nortonui.exe running on the GPU, and unless, I manually open the Norton UI and leave it open it doesn’t appear in Task Manager. Seeing that process in Task Manager is also the only way to close that process as the UI doesn’t run in the back ground.
SA
@SoulAsylum did you use taskmanager to see the activity or the “nvidia gpu activity” shortcut in your taskbar? In taskmanager I dont see it as active, but in the Nvidia GPU activity shortcut (you can enable that in NVIDIA driver panel) it keeps running. When using armoury crate from my ASUS laptop i can see that the DGPU is active due to that. The trick from @Arturas_Meskauskas works though. Just disable and then re-enable the NVIDIA display adapter in devicemanager. If i do that, the NVIDIA is used for heavy 3d applications while the laptop runs way cooler/quieter when just doing officework.
Driverversion is 591.91 (latest ones from ASUS).
1 Like
Hi All
Something that might be related here is the DeepFake Protection feature. Try clicking on Scam Protection from the main 360 user interface and turning off DeepFake Protection and test.
I have a later version of the driver shown here:
Since I did that driver upgrade (mentioned in previous post), things have been much better in regards to lack of video hardware crashes. I was overdue for that driver upgrade and glad I did it.
Ted
That I did earlier last month from a previous post/suggestion on this thread:
It has worked for me up to this point.
Ted
1 Like
I was also seeing GPU usage by Norton 360 (nortonui.exe), even after disabling deepfake protection. It was using between 1 to 2% of the GPU as soon as Edge was opened to my home page. It would drop to zero when the browser was minimized or closed. I believe this started occurring after a program update around May 5, 2026.
After Norton was updated to v26.5.10994 yesterday, GPU usage by Norton 360 is still 1 to 2% when Edge is active. But now the process that is using the GPU is Norton Antivirus (model_host.exe). What is weird is that it seems to be a “rogue” process that is not grouped with the other Norton Antivirus processes.
Although the usage is low, it is enough that it raises temperatures of the GPU by 1 to 2 degrees which causes the fans to kick in. I would like it to stop.
Have you attempted to see what the file location is on your HD? Next PVR is also loaded, wondering whether that may be a part of the trigger in some fashion?
SA
The file “model_host.exe” is located in “C:\Program Files\Norton\Suite”.
I’m not sure I follow your reasoning behind Next PVR possibly being part of the trigger. Why would you zero in on that process specifically as something that could be causing Norton’s GPU usage when Edge is active given all the other processes that are running?
As I have stated before the “model_host.exe” file is not present in my installs as of this posting. Your screenshot shows 1.1% GPU usage by a Norton process, that alone isn’t enough to force hardware to make itself spike to the point a system runs hot. I also noted that you stated when you opened Edge itself that value spiked. Unless you have disabled it Edge will use AI by default. Co-Pilot assistant is also integrated into Edge as well. I’m not saying Norton isn’t playing a part in the problem but that these are the most likely triggers for it.
My reference to PVR is - Its a personal video recorder, most of these software titles are resource heavy and DO task your GPU while streaming, decoding video.
Your browser: Edge - Edge Webview also tasks your GPU.
Microsoft Edge WebView2 utilizes your device’s GPU by default for hardware-accelerated rendering and performance. Powered by the Chromium engine, it splits tasks into multiple processes, including a dedicated GPU process to ensure smooth web content display within native Windows applications.
Edge, AI and Co-Pilot:
AI Overview
Yes, Microsoft Edge uses AI by default. Microsoft has deeply integrated its Copilot AI into the core experience of the desktop and mobile browser. [1, 2, 3]
Key AI features active by default include:
- Core Copilot Assistant: The AI can summarize the current web page, analyze open tabs, or help you compose text right from your interface. [1, 2]
- Scareware Blocker: Local AI is used in the background to protect you from full-screen scam takeovers. [1]
- Writing and Productivity: AI-powered writing assistance (for grammar and spelling) is active by default across most web forms and emails. [1, 2]
- Media Creation & Translation: Features like AI-generated podcasts from articles, and AI voice/vision interactions are built directly into the browser. [1, 2]
How to manage or turn off these features:
While AI is foundational, you can turn off or adjust many of these capabilities if you prefer a traditional browsing experience. [1, 2, 3, 4]
- To toggle Copilot settings, go to the three dots (Menu) > Settings > Copilot and AI.
- To simplify your New Tab page (the home page) and hide AI content cards, click the settings (Gear icon) in the upper-right corner of a new tab and select the Focused layout
SA
1 Like