Full definitions updates don't happen unless I manually check for updates

[Dinobot2]

Over the last few days i've noticed that Avast, intermittently, won't fully update update the definitions automatically even though I have Avast set to Automatically update my virus definitions; it'll only do the streaming updates every 3 or so minutes like usual (verified that it's at least doing the streaming updates by checking the defs folder in Avast's Program files folder). I've noticed this by taking screenshots of the latest definitions version and numbers of definition from the 'About' screen in Avast UI, and then comparing that screenshot to the 'About' screen at a later time, sometimes as long as 10 hours later when the calendar day has shifted over (so, in this most recent case, checking at around 11 pm on Dec. 9th and then again at 9 am Dec. 10th), which makes it more noticeable since the definitions version is formatted YYMMDD-version number (so right now I have 221210-6, which I assume means the 6th update for Dec. 10th, 2022). I'll notice that after a long time, the definitions version and the number of definitions won't change from my screenshot, but then when I hit "check for updates" it'll do a full update and jump several versions ahead (so this morning on Dec. 10th it went from 221209-8 to 221210-4, and just now after manually checking for updates it went from 221210-4 to 121210-6). Now, i've also noticed that it will sometimes update automatically, at least to some later version - I tested this yesterday when I left for work and then when I came back - but the fact that it's even happening intermittently is concerning.

I noticed this both before and after updating Avast to 22.12 this week (currently on build 22.12.7758.764), and before and after doing a repair and restarting my computer. It's also possible that this is just the way Avast works sometimes and it doesn't automatically update to the newest version automatically and just eventually does it, but even the above gap from last night to this morning with no full automatic update (just streaming updates) has me a bit concerned.

Has anyone else noticed this? Is this the way Avast normally works or is there something wrong with my installation that a repair couldn't find?

EDIT: One thing I forgot to mention was that some time last week a day or two after re-installing version 22.11, that the number of definitions from the About screen said '0', which I thought was odd since the definition version was the most up-to-date. When I hit "Check for Updates" and it updated it showed the correct number of definitions on the About screen (more than 23 million), and I haven't seen it show '0' since then. This was also before updating to 22.12, and before repairing and restarting. Still, thought it was worth mentioning.

[DavidR]

Personally I haven't noticed this, but I'm not always looking over Avast's shoulder so to speak.

I don't allow auto program updates, preferring to manually update, being a regular in the forums, I tend to look at the release notes when a program update is posted and see what it has to offer.  So I'm not on the latest program version, see attached (but Virus definitions are up to date. 

Something to note is that you should also be getting the Streaming updates (unless you have disabled that), which happen very frequently.  This in effect would be maintaining the virus definitions until you receive the next Virus Definitions update.

[Dinobot2]

I'm not referring to program updates - I handle those manually as well. I'm referring to definitions updates. Those I want automatically since they happen several times a day and I don't want to rely on myself to manually check for updates in definitions.

Additionally, I did mention in my post that I still get the streaming updates, referencing the same defs folder you provided a screenshot of. My concern is specifically with the main definitions updates that don't seem to be consistently coming in automatically and that I sometimes have to manually check for updates to receive and install.

[DavidR]

And neither was I (directly), just indicating what version I had, so may differ from your issue.

I missed that amongst the rest of the information.

My main reason for mentioning it, was that with the frequent streaming updates, not getting the virus definitions isn't as critical as people might think and also when there is a greater discrepancy in the virus definitions you have and the latest on there is normally a notification.

I shan't trouble you any further.

[Dinobot2]

If the streaming updates are there to fill in the gaps in between big updates, and them working and going means things are fine, then that's great. But one question that does raise is: Why doesn't the total number of definitions (from the About screen) increase with those streaming updates? Is the purpose of the streaming updates just to update the definitions already there? My understanding was that streaming updates updates the number of definitions as well, just in much smaller quantities.

[DavidR]

How would we know how they arrive at the number of virus definitions and does it really matter.  There are many generic signatures that detect more than just one piece of malware.

A very long time ago there used to be regular optimisations of the virus signatures, so the actual number of signatures displayed in the figure went down and many complained that there were less signatures, so felt less protected.  The optimisation helped to speed scans which is a good thing.

Once the latest Virus Definition is received there is some housekeeping in that some of the streaming updates would have been incorporated in that update.  After a day or so you would notice some of the xxx_stream folder would drop off the radar.

[Dinobot2]

Yeah that makes sense.

I guess i'll just monitor it and see what happens. If it goes something like three days without updating the definition version and just doing streaming updates I'm gonna become more than a bit concerned.

[bob3160]

Yeah that makes sense.

I guess i'll just monitor it and see what happens. If it goes something like three days without updating the definition version and just doing streaming updates I'm gonna become more than a bit concerned.

Technically, it's the streaming updates that keep your system safe and protected. The definition updates are strictly for housekeeping purposes so as not overrun the computer with too many xxx_stream folders.

[Dinobot2]

So, it looks like the 'main' definitions updates indeed happen just not as often as I assumed and that it relies on streaming updates more prominently than I assumed too. One thing I didn't notice before that DavidR showed in his screenshot as well is that the streaming updates will update from the next 'full' version while you only have one of the previous versions. I'm probably not explaining that all that well but a screenshot is provided to show what I mean.

Another thing I noticed as well just this morning is that the number of definitions decreased from one update to the next. This caused some curiosity and a tad bit of concern on my part and I was about to post about it asking if anyone had seen it before, but then I saw DavidR's reply above mentioning (emphasis mine):

How would we know how they arrive at the number of virus definitions and does it really matter.  There are many generic signatures that detect more than just one piece of malware.

A very long time ago there used to be regular optimisations of the virus signatures, so the actual number of signatures displayed in the figure went down and many complained that there were less signatures, so felt less protected.  The optimisation helped to speed scans which is a good thing.

Once the latest Virus Definition is received there is some housekeeping in that some of the streaming updates would have been incorporated in that update.  After a day or so you would notice some of the xxx_stream folder would drop off the radar.

So that makes sense then, and I assume that's what is happening here: Avast consolidating some of the definitions as some of them may be redundant.

[DavidR]

The optimisation processes doesn't make some signatures redundant as such (once optimisation takes place they aren't there any longer) as the old signature once optimised would be removed.

[Dinobot2]

Ok, another definitions update question: How common is it that a streaming update goes nearly 30 minutes (and counting) without any new updates, even after a manual "Check for Updates" click?

Screeenshot provided.

[spudd57]

When I had a similar issue years ago;
I went to settings > Updates, and then cleared the proxy server settings in both definition and program updates.
I also went to the windows system and cleared any proxy settings aswell.
worked for me.
good luck

[Dinobot2]

I have no proxy server settings on for either.