Remember Norton 360’s bundled cryptominer? Irritated folk realise Ethereum app is tricky to delete

January 5, 2022 TH Author

Norton antivirus’s inbuilt cryptominer has re-entered the public consciousness after a random Twitter bod expressed annoyance at how difficult it is to uninstall.

The addition of Ncrypt.exe, Norton 360’s signed cryptocurrency-mining binary, to installations of Norton antivirus isn’t new – but it seems to have taken the non-techie world a few months to realise what’s going on.

Back in June, NortonLifeLock, owner of the unloved PC antivirus product, declared it was offering Ethereum mining as part of its antivirus suite. NortonLifeLock’s pitch, as we reported, was that people dabbling in cryptocurrency mining probably weren’t paying attention to security – so what better way than to take up a cryptocurrency miner than installing one from a trusted consumer security brand?

In return for you voluntarily installing their cryptominer on your home PC, NortonLifeLock skims off a mere 15 per cent of whatever digital currency you generate. While this compares well to the 100 per cent takings that criminals covertly deploying cryptominers help themselves to, some might say it’s a bit excessive for minimal effort on Norton’s part.

@Norton @TheHackersNews @WIRED @CondeNast @hacks4pancakes @SwiftOnSecurity

Norton is installing a Cryptocurrency miner called Norton Crypto (NCrypt.exe) on end user systems without so much as a dialogue during the install of its security product.

— Maxius (@mAxius) December 31, 2021

Other consumers dotted around the web have complained that they find it difficult to uninstall the Norton cryptominer.

We have asked Norton for comment and will update this article when we hear back from the company. According to the company’s FAQ, the function must be activated by the users themselves and requires powerful hardware to meet its system requirements.

The cryptominer is signposted during installation of Norton 360, though given the well-documented phenomenon of consumers speedily clicking away EULAs, it’s entirely likely that non-technical users are complaining about suddenly slow-running PCs without knowing they’ve got a cryptominer running with their permission.

“If you have turned on Norton Crypto, but you no longer want to use the feature, you can disable it through your Norton Crypto dashboard,” says the FAQ on Norton’s website. Uninstalling it altogether takes a bit more persistence, it appears, with users needing to disable Norton Product Tamper Protection (intended to protect the antivirus product from being disabled or deleted by malware) before going through the usual Windows uninstallation steps.

Norton isn’t alone: last year a maker of Wi-Fi routers offered to mine cryptocurrency on users’ devices if they supplied connectivity to the general public. ®