Version 26.8.11125 (build 26.8.11125.0) introduces AI machine learning into Norton

[SoulAsylum]

This version as just installed, presents new directories the previous version did not have. This is anew. As far as I am concerned this adds to the fiasco of the host file entries and redirection of data to Gen Digital “closed domains”. Have any clue what these two pieces of the puzzle are all about? ONNX files are for Training AI models!!! Please see the attached screenshot and additional AI derived information:

AI Overview

An ONNX (Open Neural Network Exchange) file is a standard, open format used to store and represent machine learning and deep learning models. Its primary use is allowing AI models to move between different training frameworks (like PyTorch or TensorFlow) and execution runtimes without being locked into a single ecosystem. [1, 2, 3]

Cross-Framework Interoperability

• Exporting models: Train a model in PyTorch or TensorFlow, then save it as an .onnx file.

• Importing models: Load that same .onnx file into a completely different framework or inference engine.

• Avoiding lock-in: Switch your production stack without needing to rewrite or retrain your models from scratch. [1, 2, 3, 4]

High-Performance Inference & Deployment

• Running predictions: Execute trained models using [ONNX Runtime](Redirect Notice) for fast predictions in production apps.

• Cross-platform execution: Deploy models smoothly across Linux, Windows, macOS, and even web browsers via JavaScript.

• Hardware acceleration: Optimize performance by pairing ONNX files with hardware backends like NVIDIA TensorRT, Intel OpenVINO, or DirectML. [1, 2, 3, 4]

Model Analysis & Visualization

• Graph inspection: View model layers, shapes, and data flow graphs using visualization tools like Netron.

• Debugging: Check input/output compatibility and validate layer operations before deploying models to edge devices or cloud servers. [1, 2, 3, 4, 5]

And not one word in the release about any of this, nor, how its related to the hosts file issue that is still, an issue. Folks. If you prefer to trust AI while its already known to have gone rouge more than once, my hat goes off to you. If, you further do not mind any company to basically hijack data from your network and devices to train AI without your permission, that is a personal decision. As always, I feel a solemn duty to be informed and inform others at the same time. The ultimate decision will be on you, as individuals to move forward with this. The driving focus on my part is. The host file additions and these additions to the latest version are interconnected.
As always this is an informed professional opinion. Please feel free to add your thoughts as well.

Regards,
SA

[Guillaume1024]

Hi SA,

A big thank you for this info; I wouldn’t have come across it without you !
Forgive my ignorance regarding AI, but I don’t understand how you can conclude from your message that the additions to the “hosts” file and the changes made to the latest version of Norton (26.8) are interdependent ?
And also, to be perfectly frank, I don’t see the need to protect this new function, nor the risk you perceive.

Thanks & have a great day.
Regards,

Guillaume

[SoulAsylum]

@Guillaume1024 The risk is privacy!! Short and sweet. The Norton hosts file entries are for those “closed domains” which we cannot ping, traceroute to or from, and will never be able to obtain an IP address for, because, they are locked down by Norton GenDigital.

The new files entries for the OONX model files that appeared in the latest release are AI training. Why would either one be present within our installs and not be interrelated? Those AI LLM’s reside in the closed domains the hosts issue presented. I cannot perceive any other reason for one or both of these appearing out of the blue, and, without anything being said from Norton/GenDigital about them.

I appreciate your personal input and opinion as always.

SA

[SoulAsylum]

Users are reporting NEW hosts file entries that are a bit different than the earlier ones. Thought I would do a breakdown for everyone about what they are designed for:

The current host file new entries and what they are being used for explanations:

www.revocation.gen-webserver.internal

AI Overview
The URL www.revocation.gen-webserver.internal functions as an internal Certificate Revocation List (CRL) or OCSP endpoint for verifying digital certificate status within a private enterprise network. Proper DNS resolution and network accessibility are critical for these endpoints to ensure accurate certificate status checking. For detailed information on managing internal certificate revocation, visit Citrix Docs.

www.redirector.gen-webserver.internal

AI Overview
www.redirector.gen-webserver.internal is a local or internal hostname placeholder often associated with helper services, network redirection configurations, or specific internal application routing in private network environments.Understanding the HostnameInternal TLD (.internal): The .internal suffix is typically used for private, non-routable local network domains or container environments rather than the public internet.Helper Services: Similar entries are sometimes mapped in local hosts files or internal DNS servers to route or capture traffic for specific local helper applications or management daemons.Configuration Context: If found in an environment configuration or routing table, it acts as a designated internal redirector node to forward HTTP/HTTPS traffic from one internal path or service to another.How to Check or Troubleshoot ItCheck Local Hosts File: Look at your system’s hosts file (/etc/hosts on Linux/macOS or C:\Windows\System32\drivers\etc\hosts on Windows) to see if an IP address is explicitly mapped to www.redirector.gen-webserver.internal.Verify DNS Resolution: Use nslookup or dig on your local network to verify if an internal DNS server is actively resolving this address.Network Proxy/Gateway: If this URL appears in an application error or browser block, check whether an internal reverse proxy, VPN configuration, or captive portal setting is misconfigured.

www.gen-webserver.internal

AI Overview
gen-webserver.internal (or similar variants like gen-webserver.local) is an internal hostname often automatically managed or added by local security software (such as Avast Web Shield) or local network devices to handle secure browser-protection features or local intranet routing.Why is this address appearing?Security Software Integration: Programs like Avast frequently add internal hostnames (e.g., gen-webserver.local) to your system’s hosts file or local resolver mechanism temporarily to scan, filter, or protect web traffic.Local Network Resolution: It points to an internal loopback or local network identifier rather than a public website on the internet.What should you do?Normal Behavior: If you use Avast or a similar antivirus suite, this entry is expected and safe. It disappears or updates when the security features toggle or update.Troubleshooting Connection Errors: If your browser fails to load a page or throws an error related to this address, try restarting your browser, clearing your cache, or temporarily disabling your antivirus web-shield features to verify if the security software is intercepting local traffic

127.0.0.1 gen-webserver.internal

AI Overview
The line 127.0.0.1 gen-webserver.internal in a computer’s system configuration tells your operating system to route all network traffic for the custom domain name gen-webserver.internal directly to your own local computer. Breakdown of the Terms127.0.0.1: This is the standard IPv4 loopback address. It acts as a digital mirror, allowing your computer to talk to itself instead of sending data out to a real network or the internet.gen-webserver.internal: This is a human-readable hostname or domain name. The .internal suffix is typically used for private or local networks that are not meant to be accessed from the public internet.Why This Entry is UsedLocal Web Development: Developers add lines like this to their system’s hosts file so they can test local web servers using a realistic domain name (like gen-webserver.internal) instead of typing 127.0.0.1 or localhost.Simulating Environments: It lets you run and test web applications locally that rely on specific internal domain names before deploying them to a live server. Where This Lives This mapping is usually found inside the operating system’s hosts file:Windows: C:\Windows\System32\drivers\etc\hostsMac / Linux: /etc/hostsWhen you type gen-webserver.internal into a web browser, your computer checks this file first, sees it points to 127.0.0.1, and loads whatever web server application is currently running on your machine’s local port.

127.0.0.1 revocation.gen-webserver.internal

AI Overview
An entry like 127.0.0.1 revocation.gen-webserver.internal in your system’s hosts file is typically created by anti-piracy or licensing verification blocks associated with software cracks, patchers, or “gen” (generator) tools for corporate applications (such as Adobe or Autodesk products).What This Entry Does127.0.0.1: This is your computer’s local loopback address. Directing a domain here forces your computer to look at itself instead of the real internet.revocation.gen-webserver.internal: This is a dummy or internal domain name mapped to your machine.The Goal: Software patchers use this trick to block the application from “phoning home” to check license validity or certificate/activation revocation status on official servers.Is it Dangerous?The entry itself is generally benign networking redirection, usually injected by third-party activation tools rather than malicious remote malware.However, using cracked software generators carries inherent security, stability, and legal risks.How to Remove ItIf you want to clean your system or remove the modification:Open Notepad as an Administrator.Open the file located at C:\Windows\System32\drivers\etc\hosts.Look for the line containing revocation.gen-webserver.internal or any related local blocks.Delete those specific lines, save the file, and restart your computer.

AI Overview
1.2.3.4 redirector.gen-webserver.internal looks like a placeholder or test string combining an example public IP address (1.2.3.4), a generic redirector component, and a local or internal domain structure (.internal).What the Components Mean1.2.3.4: A generic, non-routable placeholder IP address frequently used in networking documentation, examples, and tutorials instead of a real public IP.redirector: A networking or security term for a proxy, gateway, or reverse proxy node that sits between a user and a backend server to forward or route traffic.gen-webserver: A generic or generated identifier for a web server instance..internal: A pseudo-top-level domain or suffix commonly used for private, closed internal networks or container environments rather than the public internet.Common ContextsNetwork Testing or Configuration: It may appear in a lab environment, script, or configuration file (like an Nginx, Apache, or firewall setup) as a dummy routing target.Security & Threat Analysis: Security tools sometimes categorize generic redirector scripts or malicious redirection behavior using labels like gen (generic).If you found this string in a specific log file, configuration, or security alert, please share the surrounding context so I can provide a more precise explanation.

SA

[Win7and10]

So in plain speak, is this harmful to the computer or where is this information going. Is it looped back to Norton or just residing on your computer as a loopback to catch any nefarious activity?

This is why I don’t have Windows 11 and Copilot.

[SoulAsylum]

Nefarious? I don’t believe it to be that kind of scenario. Is it being garnered on GenDigital back end infrastructure? Absolutely. How you may ask? Norton cannot do detections without our data passing through cloud services, meaning the redirects are there for that purpose. The OONX files are most definitely for machine learning. What role they are playing in my view is the same as hosts. Saving an OONX file in “read only” attributes says its there for certain features to read. Whether that is Safe Web or something coming down the line is TBD. My working theory is the hosts and OONX scenarios are co-related. My last post with the breakdown clearly shows closed domains are being used as I had stated when the hosts issue appeared.

Regards.
SA

[SoulAsylum]

Just another follow-up discovery regarding the AI machine learning in Norton 360. These shared libraries are also installed in the latest version of N360 in the directory shown. They are related to OPENVINO as well as OONX file handling. If there is any doubt AI is being run against our hardware and local LLM’s are being created, you’d better think again.

AI Overview

OpenVINO (Open Visual Inference and Neural network Optimization) is a free, open-source software toolkit built by Intel to optimize, accelerate, and deploy deep learning and AI inference models. It converts models from frameworks like PyTorch or TensorFlow so they run fast on hardware like CPUs, GPUs, and NPUs. [1, 2, 3, 4]

You can learn more about its core components and features by exploring the OpenVINO Documentation.

Key Features

• Model Optimization: Compresses and converts models to reduce file size and latency while keeping high accuracy.

• Hardware Support: Runs AI workloads efficiently on Intel CPUs, integrated/discrete GPUs, NPUs, and non-Intel chips like ARM.

• Broad Task Support: Handles computer vision, large language models (LLMs), generative AI, and speech processing. [1, 2, 3, 4, 5]

Main Components

• Base Package: Runs standard vision and deep learning models.

• GenAI Toolkit: Simplifies running generative AI and LLMs locally

Main Components

• Base Package: Runs standard vision and deep learning models.

• GenAI Toolkit: Simplifies running generative AI and LLMs locally.

• Model Server: Deploys scalable inference services on cloud or edge servers

SA

[Gribouille342]

@SoulAsylum Merci pour ces informations importantes. C’est avec beaucoup de retard que j’ai lu avec attention votre post (j’ai terminé ma convalescence hier).

Personnellement, mes connaissances en matière d’intelligence artificielle sont très basiques. Par conséquent, vos informations me permettent d’avoir une perception plus large dans ce domaine.

A mon petit niveau et en toute humilité, j’ai conscience que la plupart des éditeurs de solutions de sécurité intègrent l’intelligence artificielle au sein de leurs produits respectifs. J’espère simplement que GenDigital traite avec sérieux la question de la “confidentialité” même si personnellement, je ne suis pas naïve. Dans le cas contraire, ce serait un très mauvais “signal” envoyé aux utilisateurs selon moi.

[SoulAsylum]

Its good hearing your recovery went well and you are back to being yourself again. Best wishes in that regard.

Companies that place / run AI against our hardware without our notification and permissions include the ones below and many more. This includes your browsers, security software ( Norton as validated here ), Adobe, META, Google, Microsoft, Chrome browser, Edge from MS, Nvidia, Alphabet, Apple, Tesla, Amazon. These are aside from, the personal usage of ChatGPT and others for home and office use. The issues my side are “without permission”. If a company must refer to their legal department for a simple answer about our devices being used in that matter, that makes the statement we should ALL be taking note of. The legal accounting isn’t in hand just yet, rest assured it IS coming. Personally, I am a breath away from removal of said products from said companies and find alternatives that don’t play on my hardware and make me pay for it financially or otherwise. A company cannot claim privacy while taking data from and training AI with it. I too am not naive in that regard either. Just trying to make everyone aware of the facts and that they have choices needing made now, not later regarding AI usage without permission and notification through a revised EULA or otherwise. Open source is looking better than it ever has. I have three distros downloaded already, not ready to pull that trigger just yet.

AI Overview

Several major tech corporations have faced intense backlash for silently pushing, bundling, or force-installing AI components onto users’ local hardware without explicit consent.

The primary companies and software involved include:

Google (Chrome)

• The Action: Google silently distributed a massive 4-gigabyte local AI model directly to users’ PCs via regular browser updates. [1]

• The Details: Security researchers discovered that the browser automatically creates an on-device directory containing a large binary file (weights.bin). This file houses the parameters for Gemini Nano, Google’s on-device AI. [1]

• The Frustration: Users report that if they manually delete the massive AI file to reclaim disk space, Google Chrome simply redownloads and reinstalls it upon the next launch. [1]

Microsoft (Windows)

• The Action: Microsoft integrated Copilot and the deeply controversial Windows Recall feature directly into the core architecture of the Windows operating system. [1]

• The Details: Windows updates have repeatedly forced AI-branded shortcuts, background processes, and system-level data scraping tools onto personal and enterprise machines alike. [1]

• The Frustration: Recall works by constantly taking background screenshots, cataloging screen activity, and analyzing local user data using AI—a system-level integration that many users never asked for and find highly invasive. [1]

Adobe (Creative Cloud)

• The Action: Adobe updated its Terms of Service to grant itself broad access to user content, paving the way for its Firefly AI models to parse local user data.

• The Details: Rather than downloading a model, Adobe pushed background cloud-connected AI components into its desktop apps.

• The Frustration: The software default-enabled settings allowed Adobe to automatically scan locally saved user content, digital artwork, and proprietary files for AI training and content moderation.

---

How to Mitigate and Stop Silent AI Deployments

If you want to stop tech companies from using your local hardware and personal storage for their AI initiatives, use these strategies:

• Adjust Chrome Settings: In Google Chrome, navigate to your advanced privacy and security settings. Disable any toggles relating to “AI features” or “Experimental AI” to signal the browser to stop using the on-device engine.

• Use Read-Only File Workarounds: For stubborn automated downloads like Chrome’s 4GB file, locate the folder (opt guide ondevice model), delete the binary file, and replace it with a completely empty text file renamed to match the original filename. Set the permissions of that empty file to Read-Only so the system cannot overwrite it.

• Switch to Privacy-Focused Software: Replace invasive browsers with open-source alternatives like Brave or Firefox. Consider moving away from stock Windows toward privacy-centric Linux distributions.

• Audit System Settings: Regularly check your OS privacy dashboards. Disable “Tailored experiences,” turn off diagnostic telemetry, and explicitly opt-out of “Product Improvement Programs” across your creative apps. [1]

SA

[Gribouille342]

@SoulAsylum Je vous remercie pour votre sollicitude c’est gentil. J’espère que je vais pouvoir avoir un peu de répit.

S’agissant de “la confidentialité” et du “consentement préalable de l’utilisateur” je partage votre point vu. Votre logique est très bonne. Cependant, comme vous le souligné, la transition vers l’open source n’est pas toujours aisée ni même possible. A titre d’exemple personnel, la plupart de mes équipements médicaux personnels sont gérés par des applications développées pour Windows, Apple ou bien Android. Dans ce contexte, le passage à l’open source est pour l’instant, impossible. Aussi, afin de limiter la transmission de mes données personnelles sans mon consentement j’ai activé (quand cela est possible), la “non-transmission facultative” de mes données personnelles.

[Win7and10]

The openvino files are already in my current version not the new version just released. Yours are dated August, however, mine have a date in June! So this was planted on the current or recent version I am on which is 26.7.11086 (build 26.7.11086.990). Very interesting. I’ll keep my hosts file “read only” for now. Do you think this AI was already in the version when the hosts file issue occurred?

[SoulAsylum]

@Win7and10 It is possible these files were there in a prior release, personally, I had no need to look for them until now.

@Gribouille342 Yes. Medical equipment is a totally different situation and reality when it comes to open source use. For the everyday things I do it may become the best way forward at some point.

SA

[Gribouille342]

@Win7and10 Merci pour vos précisions intéressantes et instructives.

@SoulAsylum Si vos activités personnelles vous permettent d’utiliser les logiciels libres c’est une très bonne alternative, en trouvant la distribution correspondante à vos besoins.

[Primetime89]

Personally I think some of this might be behind some of the reasons Norton seems to be going haywire since the hosts additions and the July update.

Like after the July update, my Program Control in Smart Firewall really likes to reset every few days across three computers. Interesting that it started after the revocation addition. More interesting it immediately did it on one computer last week after it updated to 26.8.

I’ve noticed the change from .local to .internal too.

Starting to think Norton would just be better off reverting to what it was before September 2024. Because outside of a diaboloical false positive scare in 2023, I had never had problems with Norton until they changed so much.

[FullCircle360]

True. Norton’s performance is going down day by day! It seems that some people at the top management (who usually do not understand how a software works completely) decided to introduce some ‘AI’ stuff just to make headlines and forced devs to do so. But in reality, it’s making our systems slow. Norton will lose customers soon if they don’t revert to how it was few months ago (they are already losing customers as of writing this).

[SoulAsylum]

Had a bit of free time to dig a bit more and found the executable that drives the aforementioned AI in the latest release. The files I presented earlier can be removed with disabling tamper protection temporarily, with the exception of one file. The file oonxruntime.dll which is a shared library is being executed via the file nllblDSAgent.exe. This is the Norton IDS system. See screenshot.

*Note: the file aswidsagent.exe is not present on my Windows Pro machines. AI has this incorrect as far as being related to Norton since it is specific to Avast products.

AI Overview

nllblDSAgent.exe (frequently misread or displayed as nllbIDSAgent or associated with aswidsagent.exe) is a background software component tied to Avast or NortonLifeLock security products. It typically functions as an Intrusion Detection System (IDS) agent, scanning your system for malicious or suspicious behavior. [1, 2]

Is it safe or a virus?

• Generally Safe: If it is located within your official antivirus installation folders (like Avast, AVG, or Norton), it is a legitimate security process.

• When to worry: If you do not have Norton, Avast, or AVG installed, or if the file is consuming excessive CPU/memory and is located outside of standard program folders (like C:\Windows or C:\Users), it could be malware masquerading under a legitimate-sounding name. [1]

How to handle issues (High CPU or Errors)

If the file is causing system lag or throwing errors, you can safely refresh or remove it using standard software management:

• Reinstall or Remove your Antivirus: If you suspect the file is corrupted, you can remove or fix the application.

  1. Press Windows Key + R, type appwiz.cpl, and hit Enter.
  2. Locate your security software (e.g., Norton 360 or Avast) in the list.
  3. Click Uninstall or Change/Repair. [1]

• Use Official Removal Tools: If a standard uninstall fails, you can download specialized tools directly from official support channels, such as the Norton 360 Remover Tool. [1]

• Scan for Malware: If you want to ensure it isn’t a virus hiding under that name, run a deep system scan using a trusted tool like Windows Defender or Malwarebytes

So, one must beg the question. Why is the IDS system in Norton loading an oonxruntime.dll shared library which is AI?

SA

[Win7and10]

So, since this is the version we have been presented with, should we install it or wait to see if more is reported about it. I have the notice to install on the Norton 360 interface and will probably do so soon.

AI is taking over everything; it’s not something that is going away. Case in point, even to make an appointment for service of any kind, the human voice is not human. I recognize it right away and call back to get a live operator.

[Win7and10]

FAQ: Norton AI Agent Protection

I read this in the FAQ for AI protection, could this be the reason for all of this new support for AI on the Norton IDS System?

[SoulAsylum]

@Win7and10 In my opinion, what you are asking about is a separate part of Norton protection for when, you are using Claude Code , Cursor , and OpenClaw installed on your device. The IDS and AI usage services in the cloud with the hosts and OONX files locally are a totally different horse.

SA