NortonUI.exe Silently Crashing in the Background

Norton 360 for Windows
,
1

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract:

Detailed description: Focus is taken away from my mouse when navigating/keyboard while typing because there is a program that is opening/closing in the background. I found out through ProcMon.exe that this program is NortonUI.exe

Things I’ve Tried: Turning OFF Hardware Acceleration for ALL browsers, updating my videocard drivers, reinstalling my videocard drivers, uninstalling Norton via NRnR.exe multiple times, one with keeping settings, one a full wipe.

Product & version number: Norton 360 25.12.10659.2190

OS details: Windows 10 Pro 22H2 19045.6691

What is the error message you are seeing? “C:\Program Files\Norton\Suite\NortonUI.exe” --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --force-device-scale-factor=1 --log-file=“C:\Users\WildPyro\AppData\Roaming\Norton\Antivirus\log\cef_log.txt” --field-trial-handle=9300,17061869961922287428,2172602980104378122,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file=“C:\Users\WildPyro\AppData\Roaming\Norton\Antivirus\log\cef_log.txt” --log-severity=error --user-agent=“Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Avastium (0.0.0) (Windows 10.0)” --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=713 --mojo-platform-channel-handle=11504 /prefetch:1

[1024/114350.733:ERROR:gpu_init.cc(440)] Passthrough is not supported, GL is swiftshader
[1024/115039.708:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115039.770:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115039.833:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115039.895:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115039.958:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115040.020:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115040.083:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115040.136:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/115040.192:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/124904.680:ERROR:gpu_init.cc(440)] Passthrough is not supported, GL is swiftshader
[1024/222425.548:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222425.611:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222425.673:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222425.736:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222425.798:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222425.861:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222425.923:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222425.986:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.
[1024/222426.048:ERROR:network_service_instance_impl.cc(331)] Network service crashed, restarting service.

If you have any supporting screenshots, please add them:

image
image1920×1025 495 KB

2

This has gotten to the point where it is happening every 1-2 seconds and I’m unable to type anything or use my machine. I will be uninstalling Norton 360 until someone gives me a viable solution for this. In the meantime, I will be searching for a different type of antivirus solution because this behavior is unacceptable.

-Pyro

3

What video card are you running and what modes does it support?

Norton is defaulting to GL is swiftshader, an instance of OpenGL that is software based rather than hardware based, because its not fully compatible with your video settings / hardware. That can be a bug with the video driver developer, Norton compatibility, or both.

SA

4

Videocard: AMD Radeon RX 6750 XT (12GB)

Driver: Adrenalin Edition 25.12.1

Supported APIs:

DirectX 12 Ultimate

OpenGL 4.6

Vulkan 1.3

Not sure why my graphics settings are interfering with Norton, does it need this to operate? Can I disable the feature all together? I just need it to be an anti-virus, protect me from threats, not fight with my GPU.

-Pyro

5

Much appreciate the information, things like this do help diagnose things and can be relayed back to the Dev teams at Norton.
Yes Norton has been extremely fickle about video drivers for ages. Are you using D3D or other higher res settings on your video card, aka for gaming etc.? OC on the card? I would try creating a profile that uses specifically OpenGL and save that profile. Then load the system with that profile and retest to see what difference may occur.

SA

6

I have all the default settings enabled on my system, here is a snippet from dxdiag:

image
image727×532 15.9 KB

As for my GPU drivers, I’m not overclocking the card, and all the settings are set to default with the exception of one setting that was auto-enabled:

image
image1713×588 85.3 KB

I assume this is because the monitor I have is FreeSync compatible.

-Pyro

7

Also, I’m not able to force a specific API with my GPU drivers, the choice of API is made by the application itself. The best I can do is pretend that the program “NortonUI.exe” is a game and add it to my library and I can adjust the profile to select the bare minimum settings, but this is the most I can do. This still doesn’t allow me to switch the graphics API itself (OpenGL vs DirectX vs Vulkan).

-Pyro

8

For a visual reference, these are the settings I can change after adding NortonUI.exe as a “Game”:

image
image1946×1227 281 KB

Any of these options stick out to you? They are all disabled currently.

-Pyro

9

Thanks for the very detailed information, much appreciated. Did you also consider a clean boot and test for any changes? Clean booting I mean disabling all Microsoft and

Have you considered installing the driver set here? WDDM 2.7 is quite dated back to 2020.I believe that was the release year of your device. These are the latest for your card and Windows 10 64 bit.:

https://www.amd.com/en/support/downloads/drivers.html/graphics/radeon-rx/radeon-rx-6000-series/amd-radeon-rx-6750-xt.html

SA

10

I did not try a clean boot but I will give that a shot and report back. As for the WDDM version I’m running, 2.7 is the highest applicable version I can have installed for Windows 10: WDDM Overview - Windows drivers | Microsoft Learn The latest version of WDDM is 3.2 but that’s only available for Win11 24H2. I am using AMD Adrenalin 25.12.1 which is the latest version of my graphics card driver.

-Pyro

11

I did have a chance to try a clean boot state tonight. (All startup programs disabled, and all services except Microsoft ones disabled) and unfortunately, I’m still getting multiple errors:

PID: 2668, Command line: “C:\Program Files\Norton\Suite\NortonUI.exe” --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --force-device-scale-factor=1 --log-file=“C:\Users\WildPyro\AppData\Roaming\Norton\Antivirus\log\cef_log.txt” --field-trial-handle=3204,291584864862848590,12491982115181163479,131072 --disable-features=CalculateNativeWinOcclusion,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SameSiteDefaultChecksMethodRigorously --disable-gpu-compositing --lang=en-US --log-file=“C:\Users\WildPyro\AppData\Roaming\Norton\Antivirus\log\cef_log.txt” --log-severity=error --user-agent=" (0.0.0) (Windows 10.0)" --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --disable-gpu --disable-webgl --disable-gpu-compositing --allow-file-access-from-files=1 --force-device-scale-factor=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=9852 /prefetch:1

Any other ideas?

-Pyro

12

I’m at a loss for next steps. My best senses tell me something about your specific hardware and PC setup doesn’t jive with Norton. This would be a wide spread reported issue if that weren’t the case. Nevertheless I am escalating to someone at Norton to get this to the Dev team for a resolution. You and I have done all that we can on our part, thank you much for taking the time working with the TS as well. Next steps will be someone Norton making contact here with you via this thread and/or a private message here on the forums message board.

SA

1 Like
13

I appreciate the effort. I will be awaiting the next steps from you or the Dev team to reach out. I hope you have a happy holidays!

-Pyro

14

Have a grand holidays to you and your family as well. I hope we can get this resolved ASAP.

SA

15

Just an update for you before the holiday break. A Norton team member HAS reviewed my escalation for this thread. Going forward, be looking for a Norton employee to either directly post here, post a private message to you on the forums message boards or both. Hoping we can get this figured out for you soon.

Regards,
SA

1 Like
16

@WildPyro I don’t know whether this is relevant to your setup but you may be interested in what I found re. ad-blocking.
See Focus window issue Norton 25.10 - #26 by user10572 and Focus window issue Norton 25.10 - #28 by user10572 .

The loss of focus issue is definitely much improved by v25.12.10659, but not resolved. Thank you for your post above - this lead me to look Process Monitor. I similarly have the UI process exiting and restarting. The cef_log.txt file in AppData\Roaming\Norton\Antivirus\log contains repeated entries of

Network service crashed, restarting service.

So it looks like the application isn’t cleanly handling not being able to access the URL.

17

Thank you for this information. It has gotten to the point where I have uninstalled Norton 360 due to the fact that this was happening multiple times per second rending my machine unusable. I will re-install it and keep an eye on my network-level adblocker (Two DNS PiHoles) to see if the site ipm.avcdn.net gets mentioned in the blocked query list. Also, happy new year!

-Pyro

18

After re-installing Norton 360, it immediately started crashing and I watched my PiHole DNS queries for the ipm.avcdn.net URL and low and behold, it matches up PERFECTLY with the crashes on the right:

image
image2560×1066 332 KB

I have just white-listed this address and will report back after a few hours to see if the crashes have truly stopped. Thank you very much for bringing this to my attention!

-Pyro

19

Glad that was helpful. I’ve spent a few hours chasing through this, as have other people. Very poor coding by Norton. You should see in the PiHole query log that once a successful call has been made, that URL only gets called every 30 to 40 minutes

20

After white-listing that URL, I haven’t seen any restarts of NortonUI.exe almost 18 hours later so I guess this fixed the problem. This begs the question though, why exactly does this make the Network Manager crash in the background multiple times, but like you said, terrible coding on Norton’s part. Just glad I finally have an active AV on my computer that doesn’t crash every few seconds!

-Pyro