Norton Threat blocked - C:\Users\xxxx\AppData\Local\BraveSoftware\Brave-Browser\User Data\Safe Browsing\UrlBilling.store.4_13389496143122659

Browser Support Desktop Support
1

Description of the issue:
How can this issue be reproduced?

  1. Received an message from Norton 360 “Norton Threat blocked - C:\Users\xxxx\AppData\Local\BraveSoftware\Brave-Browser\User Data\Safe Browsing\UrlBilling.store.4_13389496143122659 - File - Infected”
  2. Quarantined the file temporarily
  3. I wasn’t at my computer when this message was triggered so I have no idea how a Brave specific file was all the sudden infected. Maybe a false positive though since a Brave update was waiting. :man_shrugging:

Expected result:
I expect brave files to not be infected. :laughing:

Brave Version
Version 1.77.97 Chromium: 135.0.7049.84 (Official Build) (64-bit)

Additional Information:
N/A

2

While waiting for Brave Support . . . some basic info: “UrlBilling.store” is an SSL Keystore file that holds the identity key for probably a Safe Browsing server involved in two-way SSL:

Something to do with achieving, maintaining, and keeping a record of secure connections AND secure (encrypted) info transfers, between the Brave Browser and an online Safe Browsing reference. (My guess.)

Some examples of files in the Safe Browser folder at:

C:\Users\xxxx\AppData\Local\BraveSoftware\Brave-Browser\User Data\Safe Browsing\

  • ChromeExtMalware.store
  • ChromeExtMalware.store.32_13387619606277693
  • UrlBilling.store
  • UrlBilling.store.4_13387768349757760 (resembling your suspect file)

Those are all files (among a total of 20), that I found in a Safe Browsing folder of a Brave Browser (Windows OS) installation, backed up a few weeks ago.

You may have to wait until after the weekend, to get specific, False Positive or Malware, info from @Mattches of Brave Support, though sometimes @Evan123, or another member of the Brave team, shows up during a weekend.

3

@trongod I believe it’s very likely a false positive, especially if you weren’t downloading anything else or browsing anywhere shady at the time.

I’ve asked our security team to confirm and will also submit the false positive report to Norton as well.