Tracking thread for the new version 25.xx release

[SoulAsylum]

Check your inbox please!!

SA

[Brocktoon]

I’ve noticed since updating to the newest v25.8, the software updater seems to be running in the background more frequently. I don’t have it set to update anything, but you can’t turn off the checking. Before it may have run once a week. Now think it runs after every reboot or possibly more frequently? Not sure as I can figure out a pattern other than it’s much more frequent.

I guess not a major issue as long as I have auto updates turned off

[SoulAsylum]

Its in my task manager, sitting without any active CPU usage, 99% of the time my side. My history shows it running every 5 days. That is the extent of history I have since I had to do an emergency restore a few days ago. One Drive began removing files and deleting apps while it was synching to the cloud. Not good. I will monitor DU going forward to see if the 5 day frequency is built in or just a fluke.

SA

[SoulAsylum]

Update: My personal laptop now has the latest version installed. Updates for Norton and Windows 11 went without any issues. System resources are adequate and the suite is fully functional for my needs. The other issues we are all waiting for, IE firewall rules editing/creations etc. are still evident.

Also of note, I have also made a discovery that has answered some of the whys and the hows certain things are happening with the newer versions of Norton. I won’t make that available until confirmation from Norton can be made. Just want to be accurate vice subjective.

SA

[kencl]

I’ve now received the 25.8 update and performed my routine test to see if there’s a fix for the problem of Security History being flooded with UDP(17) reports if NetBIOS over TCP/IP is enabled. Needless to say, it’s still not fixed.

[SoulAsylum]

@kencl Did you disable the netbios settings in your network adapter settings as shown in these posts?

Tracking thread for the new version 25.xx release

NetBIOS setting → Default: [NetBIOS1] [690]

^[1]Tracking thread for the new version 25.xx release - #109 by bjm

SA

---

1. Footnotes ↩︎

[kencl]

Yes. As I said in my first post to this topic (post #147), I disabled NetBIOS to stop the UDP(17) problem, having seen the suggestion in an earlier post. Then, as I’ve reported in subsequent posts, with each new release I re-enable NetBIOS to test if the issue has been fixed and then disable again once I’ve seen that the problem still exists. After each of those tests, in Security History I select Firewall Activities and clear all those entries to remove the UDP (17) clutter from the default Recent History display.

Note: I set the NetBIOS setting to Disable not Default. Default allows setting via DHCP so effectively enables NetBIOS - that does not fix the problem. Disable stops the problem.

[SoulAsylum]

Yes, I was just reminding that the UDP 17 issues have not been corrected. Please review this thread where I did some backside research. The similarities are startling.

Norton 25.7.xxx products and files for OPSWAT

There have been posts/threads where many instances of Norton detections are being a wee bit too touchy. False positives, firewall and the AV itself putting files into quarantine where they cannot be removed, the list is long and varied. Like older 22.xx versions where we were seeing two specific files, I am back to them once again, with suspicions about maybe. These should be the main focus of what all the extra high detections are all about. Below, is a screenshot of where the two files are loc…

SA

[SoulAsylum]

FYI!! Norton version 25.9.10453 is officially in a phased released. The announcement link is below. Please advise if any of the issues here are corrected once you have the update installed, rebooted and rechecked.

Norton Security 25.9.10453 for Windows is now available!

We are happy to announce the release of Norton Security 25.9.10453 for Windows! Norton Security helps protect your Windows computer with multiple layers of protection against viruses, ransomware, spyware, phishing, trojan horses, scam and other online threats as you bank, shop, and post online, and your private and financial information when you go online. As with our previous updates, this version is being released in a phased manner. This update is available in all supported languages. To do…

Regards,
SA

[M_Tee]

My Windows 11 PC updated to Norton 360 25.9.10453 yesterday. Since then, when I open a browser with multiple saved tabs after booting, NortonSvc.exe soon encounters an application error, and DNS queries timeout thereafter, until I reboot.

I’ve generally had good luck with Norton, and the present situation is rather distressing.

I have tried a full product uninstall and reinstall (twice), and confirmed Windows system file integrity. As an experiment, I tried backing-out a recent KB that updated ucrtbase.dll to the version shown in the screenshot, but that didn’t help.

[SoulAsylum]

@M_Tee

ucrtbase.dll

@M_Tee What is the full version of your Windows installation? The faulting module, file ucrtbase.dll crashing is caused by Windows SDK.22624, this suggests you are running an insider build of Windows 11, the exception error listed is “STATUS_STACK_BUFFER_OVERRUN”, more AI info:

*Please note that Norton does not claim its products will work correctly with insider/BETA software due to the constant changes in those builds.

AI Overview

The Windows exception code

0xc0000409 translates to STATUS_STACK_BUFFER_OVERRUN. It indicates that an application has corrupted a stack-based buffer, a security-critical failure that causes the program to terminate to prevent a malicious user from gaining control. The reference to “Windows SDK.22624” suggests the error occurred during an application’s development or execution on a system using this specific version of the Windows SDK.

Potential causes

• Application-specific memory issue: The most direct cause is a bug in the application’s own code. For example, a program might write more data into a local variable on the call stack than the variable is sized to hold. The Windows OS detects this “buffer overrun” and throws the exception.
• Corrupted system files: The application could be triggering the error due to corrupted or missing system files. This is often the case if the issue appears suddenly and affects multiple programs.
• Third-party component conflicts: A dependency or third-party library used by the application could be mishandling memory. Conflicts with security software like antivirus programs can also trigger this exception.
• Outdated or corrupt redistributables: Missing or mismatched Microsoft Visual C++ Redistributable packages can cause conflicts, especially with applications that rely on specific runtime libraries.
• Incompatible application versions: The application may not be compatible with the version of the Windows SDK (10.0.22624) or the version of Windows on which it is running.

^[1] AI can make mistakes, the information provided is as is and based on the latest finding in web results.

SA

---

1. Footnotes ↩︎

[M_Tee]

Hi. I think the AI is a bit confused, particularly regarding its reference to “Windows SDK.22624”. The Windows 11 build info is:

Edition Windows 11 Pro
Version 24H2
Installed on ‎8/‎15/‎2025
OS build 26100.6584
Experience Windows Feature Experience Pack 1000.26100.234.0

which I don’t believe is anything exotic. The specific build and ucrtbase.dll version came in through Windows Update via a recent roll-up KB, KB5065426, after being originally released by Microsoft as a preview in KB5064081. As I noted in my post, I tried removing KB5065426 to see if that resolved the application errors, but alas it did not.

[M_Tee]

I can provide an update regarding my report above.. The product support team ran a remote session for much of the afternoon, to gather data and logs to escalate the issue to level 3. One finding from today’s investigation is that the Application Errors on my PC are associated with the Safe Web feature, and toggling that feature off within Norton 360 for Windows appears to provide a temporary work-around.

[SoulAsylum]

Thanks for the post back. Indeed, AI can make mistakes, thus, my footnote at the bottom on my post. The faulting module was C:\Windows\System32\ucrtbase.dll and looking up the exception code 0xc0000409 it gave the results for buffer overrun in the current stack. Memory management in other words. The SDK shouldn’t be the issue at hand, I have Windows 11 Pro 24H2 latest update on several systems with totally different hardware, the current Norton version running on at least two of those devices and not seen this issue occur. What browser are you using when opening with multiple saved tabs? Curious.

How do you diagnose the exception code 0xc0000409 on Windows?

SA

[M_Tee]

The browser that reliably triggers the stack overflow that takes down NortonSvc.exe on my PC is Firefox version 143.0.1. The saved tabs that are restored at start include 6 Google Workspace, 4 Slack, and several miscellaneous URLs.

I did some additional experimentation after the remote session with the product team concluded on Friday, and found that it is unnecessary to disable the entire Safe Web feature of Norton 360 for Windows to achieve stable operation on my PC. Rather, turning off the “HTTPS scanning” sub-feature is sufficient.

[SoulAsylum]

Thanks for the feedback, I had thought about suggesting the HTTPS scanning be disabled, that presents an issue in itself and could leave you vulnerable. Norton obviously is having a hard time loading and checking those tabs and URL’s they are linked to each time. The memory stack is being given more tasking than it has resources. May I suggest disabling fast boot in Windows and restarting to recheck? Allow the system to release the data its constantly storing over and again.

SA

[M_Tee]

Thank you for the suggestion. I tried the following:

1. Disable fast boot in Windows 11
2. Re-enable HTTPS scanning in Norton 360 for Windows
3. Shutdown the PC
4. Power the PC back on
5. After booting, open the Firefox browser with the problematic set of saved tabs

Shortly thereafter, NortonSvc.exe encountered a stack overflow, as before.

So, alas, it would appear that fast boot is not a factor in the failure.

In any case, my understanding is that the data and logs gathered by the product support team on Friday will be provided to the level 3 team, who hopefully will be able to pinpoint why Norton 360 for Windows 25.9.10453 is running into trouble on my PC. Meanwhile, it would seem that I need to leave HTTPs scanning turned off, as a (hopefully) temporary workaround.

[SoulAsylum]

Thanks for the post back. My though is the saved tabs in FF is where my process is leaning. FF is trying to duplicate something Norton has a function for and your memory stack is the consequence of that. Please let us know what the log results are.

SA

[paul_murphy2]

@SoulAsylum Well said concerning AI and privacy. I am pretty sure you know more about AI than me, but I think I’m close to your knowledge in privacy concerns. Distressing situation.

[SoulAsylum]

Another intelligent firewall thread regarding the 25.9.xxx version, wanted to add it here for Norton to track:

Intelligente Firewall

Hallo, unglaublich aber war: seit dem Update von gestern habe ich Probleme mit der Programmsteuerung in der Firewall. Meine dortigen Einstellungen (Zulassen = 59 / Blockieren = 12 / Benutzerdefiniert = 0) werden nicht beibehalten und ändern sich automatisch ohne mein zutun. Aufruf der Übersicht um 08:38 Uhr: [Bild 1] Aufruf der Übersicht um 08:39 Uhr: [Bild 2] Aufruf der Übersicht um 08:10 Uhr: [Bild 3] Hinweis: Auf meinem Laptop habe ich genau des gleiche Verhalten festgestellt. Dan…

@Gayathri_R

SA