# Norton Threat blocked - C:\\Users\\xxxx\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Safe Browsing\\UrlBilling.store.4\_13389496143122659

**URL:** <https://community.brave.app/t/norton-threat-blocked-c-users-xxxx-appdata-local-bravesoftware-brave-browser-user-data-safe-browsing-urlbilling-store-4-13389496143122659/612706>\
**Category:** Desktop Support\
**Tags:** windows\
**Created:** [April 19, 2025, 5:21am UTC](https://community.brave.app/t/norton-threat-blocked-c-users-xxxx-appdata-local-bravesoftware-brave-browser-user-data-safe-browsing-urlbilling-store-4-13389496143122659/612706 "2025-04-19T05:21:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![trongod](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@trongod](https://community.brave.app/u/trongod)\
**Post date:** [April 19, 2025, 5:21am UTC](https://community.brave.app/t/norton-threat-blocked-c-users-xxxx-appdata-local-bravesoftware-brave-browser-user-data-safe-browsing-urlbilling-store-4-13389496143122659/612706/1 "2025-04-19T05:21:30Z")

</div>

* * *

**Description of the issue:**  
**How can this issue be reproduced?**

1. Received an message from Norton 360 “Norton Threat blocked - C:\Users\xxxx\AppData\Local\BraveSoftware\Brave-Browser\User Data\Safe Browsing\UrlBilling.store.4\_13389496143122659 - File - Infected”
2. Quarantined the file temporarily
3. I wasn’t at my computer when this message was triggered so I have no idea how a Brave specific file was all the sudden infected. Maybe a false positive though since a Brave update was waiting. 🤷‍♂️

**Expected result:**  
I expect brave files to not be infected. 😆

**Brave Version**  
Version 1.77.97 Chromium: 135.0.7049.84 (Official Build) (64-bit)

**Additional Information:**  
N/A

---

<div class="post-metadata">

**Author:** ![289wk](https://avatars.discourse-cdn.com/v4/letter/2/439d5e/32.png) [@289wk](https://community.brave.app/u/289wk)\
**Post date:** [April 19, 2025, 8:15am UTC](https://community.brave.app/t/norton-threat-blocked-c-users-xxxx-appdata-local-bravesoftware-brave-browser-user-data-safe-browsing-urlbilling-store-4-13389496143122659/612706/2 "2025-04-19T08:15:53Z")

</div>

While waiting for Brave Support . . . some basic info: “UrlBilling.store” is an [SSL Keystore file](https://docs.oracle.com/cd/E52734_01/omss/AMSAS/msas-config-ssl.htm#AMSAS6736) that holds the identity key for _probably a Safe Browsing server_ involved in two-way SSL:

Something to do with achieving, maintaining, and keeping a record of secure connections AND secure (encrypted) info transfers, between the Brave Browser and an online [Safe Browsing](https://support.brave.com/hc/en-us/articles/15222663599629-Safe-Browsing-in-Brave) reference. (My guess.)

Some examples of files in the Safe Browser folder at:

`C:\Users\xxxx\AppData\Local\BraveSoftware\Brave-Browser\User Data\Safe Browsing\`

- ChromeExtMalware.store
- ChromeExtMalware.store.32\_13387619606277693
- UrlBilling.store
- UrlBilling.store.4\_13387768349757760 (_resembling your suspect file_)

Those are all files (among a total of 20), that I found in a Safe Browsing folder of a Brave Browser (Windows OS) installation, backed up a few weeks ago.

You may have to wait until after the weekend, to get specific, _False Positive_ or _Malware_, info from @Mattches of Brave Support, though sometimes @Evan123, or another member of the Brave team, shows up during a weekend.

---

<div class="post-metadata">

**Author:** ![Mattches](https://sea1.discourse-cdn.com/brave/user_avatar/community.brave.app/mattches/32/25189_2.png) [@Mattches](https://community.brave.app/u/Mattches)\
**Post date:** [April 21, 2025, 4:45pm UTC](https://community.brave.app/t/norton-threat-blocked-c-users-xxxx-appdata-local-bravesoftware-brave-browser-user-data-safe-browsing-urlbilling-store-4-13389496143122659/612706/3 "2025-04-21T16:45:58Z")

</div>

@trongod I believe it’s very likely a false positive, especially if you weren’t downloading anything else or browsing anywhere shady at the time.

I’ve asked our security team to confirm and will also submit the false positive report to Norton as well.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/brave/original/3X/1/8/182067f3480d1a5e7aea5ae3131b116ca1ef7918.png) [@system](https://community.brave.app/u/system)\
**Post date:** [May 21, 2025, 4:46pm UTC](https://community.brave.app/t/norton-threat-blocked-c-users-xxxx-appdata-local-bravesoftware-brave-browser-user-data-safe-browsing-urlbilling-store-4-13389496143122659/612706/4 "2025-05-21T16:46:14Z")

</div>

Closed on May 21, 2025, 4:46pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.