To hallucinogenix: I think Vlk answered your question - it looks like that if you use the offline vps definitions update from Avast, that your program version will update - I didn't know that; but for all intents and purposes, I would actually give it a try - now don't hold that against me - it's not a recommendation, it's just something I would do, and I tend to try everything and anything to get something to work - so personally, that is what I would do, try the offline update, and see if just the vps definitions update; and hopefully the program version doesn't update. If it does, have a copy of version 9.0.2008 ready, and reinstall that version - and continue to block the program update with your firewall, and unfortunately you will also have the outdated definitions. That being said, as I posted in my original post I suspect the culprit, which I am guessing is sent over the Avast servers, is a service called emhwid from Avast. My program ProcessHacker noticed it and notified me of it in an info pop-up bubble from the taskbar. The thing is, I think the Avast servers send it, it updates the program version, and then it is deleted by the servers I guess. Which seams kind of sneaky. I have searched for emhwid on my computer, and it is not there. Maybe you could block the service emhwid with your firewall, or a HIPS. And the vps definitions could update, but not the program version - although this seems difficult, and probably technically not possible. PS, I think emhwid means emergency hardware identification - or something to the effect, that Avast created to update program versions they consider obsolete and abandoned.