Deciphering avast's Different Download Sources

[Chim]

Having been at my sister's place yesterday, I went crazy with her High Speed Internet.

I decided to download myself a fresh batch of avast's latest version.
I do this periodically so that in case I ever have to reinstall avast, I don't have to endure a HUGE download of Virus Definitions Updates on my Dial Up if I use an old download Setup File.

I used the: http://files.avast.com/iavs5x/setup_av_free_eng.exe link.

With that one, the Setup File Size was 43.7 MBytes.

The Setup File from FileHippo was 52.5 MBytes.

Then there was the C/Net download.com Setup File at 49.13 MBytes.

Okay, NOW ... I am theorizing that the download from the avast site is likely the lowest because it is English only, right?
And I'm assuming the download from FileHippo is the biggest because it's probably an international / multi-language version, right?
So, what does that make the C/Net download.com download?
Why is that one somewhere in the middle in File Size?
What does it have more of than the download from the avast site ... yet has less than the download from the FileHippo site?

[igor]

Apart from the languages (and program version, of course), the installers may differ in the version of the virus database embedded inside.
The installers are sometimes refreshed with a new virus database, even if no new program update is released in between (but it's not done very often - maybe once in one or two months, certainly not for every virus database update).

I wouldn't worry about the size (as long as the installers has a valid digital signature)
The files downloaded from files.avast.com should always be the latest ones.

[Chim]

Oh, Okay ... Thanks, Igor. 

Now ... what constitutes a valid digital signature?
I Right Clicked on the download from the avast site.
I clicked on Properties.
I selected the Digital Signatures Tab.
It shows:
Name of signer - ALWIL Software
Timestamp - Friday December 3, 2010

Is THAT what constitutes a valid Digital Signature?

The one from FileHippo is from back in September.

I didn't download the one from C/Net download.com.
So I have no idea what Digital Signature and Timestamp that one had.

[igor]

Now ... what constitutes a valid digital signature?
I Right Clicked on the download from the avast site.
I clicked on Properties.
I selected the Digital Signatures Tab.
It shows:
Name of signer - ALWIL Software
Timestamp - Friday December 3, 2010

Is THAT what constitutes a valid Digital Signature?

Actually, no - and that's very confusing for most Windows users, I'd say. This only says that there is a digital signature there - but not necessarily valid (anybody can fake such a signature and make their tool "(c) Microsoft", for example).
[On the other hand, if the installer was just truncated during the download, which is what I meant by my post, the Digital Signatures tab wouldn't be there at all, so from that point of view it's OK.]

To really validate the signature (which might take a few seconds because the hash of the file has to be computed), you have to select that line with "ALWIL Software", and click on the "Details" button. A new window appears where you should see "The digital signature is OK" in the second line.

[Chim]

Alright ... Thanks, Igor!
I performed that extra "Details" step and both the download from the avast site and the download from FileHippo passed the "Digital Signature is OK" test.