Why does Avast (Home version) Setup constantly try and make TCP connections

Virtually every day, Setup will try to make connections to sites such as 70.85.93.154 or 75.126.53.172 and several more. I would have thought once I had installed the system, Setup shouldn’t try to do anything. Has it been compromised?

Check if the IP are on the servers.def file (C:\Program Files\Alwil Software\Avast4\Setup\servers.def).
If so, it’s ok, it’s part of avast update job :wink:

The first IP is for theplanet.com which provides the infrastructure for your ISP, so it may be for the DNS server, I don’t know.

The second is for avast.com and is most likely for the download servers it is trying to connect to and download any updates. This is normal for avast.setup it is part of the avast auto update process.

avast will check for updates the first time you connect to the internet and every 4 hours if you remain connected, it is doing its job.

What is your firewall ?

Hi Tech

I don’t have a file servers.def at the following location (C:\Program Files\Alwil Software\Avast4\Setup\servers.def). Is it likely to be elsewhere?

No, it should be there. Maybe hidden.

Maybe you need to disable Hide protected operating system files and enable View hidden files and folders to manage the file(s).

Hi Tech

You are quite right - i hadn’t unchecked ‘hide system files’.

Just out of interest there were 202 entries, starting with [server0] (download72) and finishing with the following pair:

[server200]
name=Download979 AVAST Server
url=http://download979.avast.com/iavs4x
stats=http://download979.avast.com/cgi-bin/iavs4stats.cgi
submit=http://download0.avast.com/cgi-bin/iavsup2.cgi

[server201]
name=Download980 AVAST Server
url=http://70.86.91.130/iavs4x
stats=http://70.86.91.130/cgi-bin/iavs4stats.cgi
submit=http://download0.avast.com/cgi-bin/iavsup2.cgi

Every pair from [server0] onwards were identical with the exception of the download number and the url identity.

Is this normal? (why so many)

Because they have to handle all the 70 millions avast! users :wink:
So yes, it is normal.