Until today I could not observe this behavior. But it happened just after I got the system message, that the file \DOKUME~1\ALLUSE~1\ANWEND~1\Alwil Software\Avast5\db1cb279762572cc0-20055c1d.dat is corrupted.
It looks a bit strange to me that the avast software tries to connect to changing IPs.
Is this behavior normal or do I have a problem?
OS: Windows XP SP2, avast program version 5.1.889, virus db 110201-1
This thread is mainly about updating. Updating works fine since a long time without accessing the IPs I mentioned above. The file ‘servers.def’ does not contain the suspicious IPs and domain names. No entry in servers.def starts with https.
That means some avast severs are hosted by theplanet.com. But this gives me no guarantee that none of their servers is malicious. The name of nearly all servers in 'servers.def." end with ‘avast.com’. No one is called ‘theplanet.com’ or ‘PRODUCTSUWANT22.COM’. BTW scandoo has stopped their service.
Still I believe something is wrong with my avast program. Either it is infected itself or it collects private data without notice.
As written previously, we are using server housing at many locations from many providers. Many servers are at theplanet.com. When we are adding new servers to our farm, we set their reverse DNS record to something.avast.com, but this depends on the provider because of the DNS protocol architecture.
Sometimes it takes longer time to set the DNS record (as it is usually batch of twenty servers), but servers are already used by us for program and virus definitions updates. In that time, they may have the old (as provider is recycling IP addresses, reverse stalls at the name of the previous customer) or default (something.theplanet.com, something.softlayer.com) reverse DNS record.
Also sometimes the reverse DNS record may change because of some administrative error at the provider.
However, avast!'s setup is using signing of files and it uses also signed list of the update servers with direct IP addresses or forward DNS address (which is under our control, so it is set before the server goes public), so it connects always to our servers.