This is handled by the AMS update mirror (the “Avast! iAVS4 Mirror Service” in services.msc). It contains its own embedded HTTP server (independent of IIS).