• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

why would Malewarebytes block Norton's ncolow.exe to multiple IP addresses?

A few times a day my Malewarebytes anti-malware program blocks outbound traffic from Norton's ncolow.exe to several different IP addresses. A common one is 204.93.185.136 (tzarmedia.com)

Why would Norton be sending this traffic?

If this is NOT really Norton traffic how shall I prevent this virus?

Replies

Kudos1 Stats

Re: why would Malewarebytes block Norton's ncolow.exe to multiple IP addresses?

You might need to open a support ticket with Malwarebytes about that.

https://support.malwarebytes.com/customer/portal/emails/new?b_id=6400

A little bit of knowledge is... well a little bit of knowledge.
Kudos0

Re: why would Malewarebytes block Norton's ncolow.exe to multiple IP addresses?

@James Kelly 49:

1st, ncolow.exe 

Are you using the Premium version of MBAM? If so, try:

1. Create a scan exclusion in your MBAM settings for your Norton software (Norton Security, aka, NS) this way:

a. Check your desktop for Norton's shortcut > right-click on that icon > choose "Open file location" > write down the installation path.

b. Open your MBAM > go to Settings > Malware Exclusions > locate and add the Norton folder to that section.

If you are just trialing that Premium version of MBAM, uninstall it > restart > reinstall the FREE version of MBAM instead.

As for tzarmedia dot com, that site or its hosting server may contain threats, according to this VirusTotal report.

Malwarebytes hpHosts    Suspicious site

2. tzarmedia dot com

Some outbound traffic to the said tzarmedia and/or other few sites could be caused by a lower-risk PUP (Potentially Unwanted Program). Just to confirm, plz perform the below actions:

  • check your programs list under Control Panel
  • scan all of the disks on your computer using an up-to-date MBAM Free later

For more info, you may Chat with Norton Support and/or make the best of Norton Virus Protection Promise if you think you are infected.

Please post back if this or any other comment solves your problem. THX...

PUP Hunter PRO: Just TRYING to save the world (U) from cyber threats, A single blog post, at a time, and ONCE & FOR ALL. (A fan of Nadia_Kovacs)
Kudos0

Re: why would Malewarebytes block Norton's ncolow.exe to multiple IP addresses?

MalwareBytes tech support had me run 2 programs FRST64 & adwcleaner both of which created logs that I sent to them. In return they sent me a FixIt list that FRST uses and I did a reboot. This process had to be repeated several times over a couple of days. The final fix and test was for me to turn off all Norton services. I did this for 2 days and then turned it on again. The outbound traffic has not returned.

Kudos0

Re: why would Malewarebytes block Norton's ncolow.exe to multiple IP addresses?

Are you running MalwareBytes in real time? Like the pro version? If so take 20750065's advice and disable it. You do not need MalwareBytes running all the time. Use it only as free on demand scanner. Norton should be the only real time protection you have running. 

This thread is closed from further comment. Please visit the forum to start a new thread.