Since September 13 2026 an error has been occurring in the Windows EventLog for every boot operation:
Schannel Event ID 36881: The certificate received from the remote server has expired
Every time it starts, Norton 360 attempts to access the following address:
packet-responder.ff.avast.com´
The SSL certificate for this site has expired as of September 13, 2026.
Please renew the certificate or disable Norton’s access to this site at startup.
Tested on 5 PCs running 3x Windows 11 and 2x Windows 10 ESU with the latest patches.
@Hans47 That URL is a legit service for both Avast and Norton products as they both use the same back end infrastructure. I have some AI information below for you to review. Before using any of its suggestions, my suggestion is, run a repair on your Norton installation from within its settings first. Restart the machine and check for the issue still being logged into your Windows Event Viewer logs. If it is AND, doesn’t break any functionality I would just ignore it for the reason that. The certificate that is being detected is on the remote server for Norton/Avast services not your machine.
AI Overview
Norton 360 uses domains like packet-responder.ff.avast.com because NortonLifeLock and Avast (Gen Digital) share backend infrastructure, telemetry, and threat-intelligence components following their corporate merger.
Why Norton Connects to Avast Domains
Shared Infrastructure: Norton and Avast are both owned by Gen Digital (formerly NortonLifeLock), leading to shared definitions, cloud services, and update servers.
Telemetry and Threat Intelligence: Components of the software utilize shared Avast network infrastructure and subdomains (like ff.avast.com for fast-flux or packet-responding services) to sync threat feeds or telemetry data.
Event Log Errors: Recent certificate expiration issues on subdomains like packet-responder.ff.avast.com have surfaced in Windows Event Logs for Norton 360 users, confirming ongoing integration where backend API endpoints cross over between the two brands
And:
AI Overview
An expired certificate error for packet-responder.ff.avast.com in your Windows Event Log typically occurs due to an internal backend telemetry or packet-scanning component remnant from Avast interacting with or overlapping a security suite (like Norton) on your system. [1]
Why This Happens
Shared Infrastructure / Legacy Components: Avast and Norton use deep packet inspection and SSL/TLS scanning that can occasionally log background telemetry or responder subdomain handshakes.
Expired Server Certificate on Avast’s End: The domain packet-responder.ff.avast.com is hosted by Avast, and if an internal tracking or response certificate expires on their servers, your local security software’s background logs will flag the untrusted/expired handshake. [1]
How to Fix or Clear the Error
Ignore if Non-Intrusive: If this is only appearing as a background entry in the Windows Event Viewer and your PC is functioning normally, it is a server-side certificate expiration on Avast’s infrastructure that Avast must update. It does not impact your Norton protection or system security. [1]
Remove Leftover Avast Files: If you recently switched from Avast to Norton, leftover registry entries or background tasks might still be trying to poll Avast servers. Use the official Avast Uninstall Tool in Safe Mode to completely scrub residual files and background services.
Check for Norton/Avast Overlap: Ensure you do not have both Avast and Norton actively installed or running conflicting web/mail scanning extensions, which can cause certificate mismatch errors in Windows logs