Member Avatar for toryander

I've cleaned a computer of viruses and malware. The computer is now working great. All software appears to be running fine. This computer is running Avast Antivirus. The problem is that I noticed that Avast cannot update it's virus definitions. I would think this an Avast software problem except that I also noticed that Malwarebytes and Superantispyware (these are there just temporarily) cannot update their definitions either. This tells me it is a computer problem. Apparently the port they use to update is blocked. I don't know how to find out what port or how to unblock. I did notice that I can update in Safe Mode. I looked at the processes when in normal mode and nothing stands out. Any ideas? (I've reset the Tcpip stack and reset the winsock catalog, I've checked the hosts file and it is clear).

  • 5 Contributors
  • 6 Replies
  • 220 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by techsheaven

Dani AI

Generated

Because the AVs update successfully in Safe Mode, the problem is almost certainly a component that runs only in normal mode — not the TCP/IP stack or hosts file (those were already checked). , and were right to look at firewalls, and ’s idea to remove conflicting security suites is useful — but start with targeted diagnostics so the exact culprit can be found.

Try this focused checklist in order:

  • Check for a proxy (malware often installs one). In Internet Options → Connections → LAN settings confirm “Use a proxy server” is unchecked. Also check the system WinHTTP proxy:

    netsh winhttp show proxy

  • Do a clean boot to isolate third‑party software: run msconfig, hide Microsoft services, disable remaining non‑Microsoft services and all startup items, reboot and test. If updates work, re-enable services/startup items in groups to find the offender.

  • See which process is touching network ports. Run:

    netstat -ano

    Note suspect PIDs and map them with:

    tasklist /fi "PID eq <pid>"

    Or use Sysinternals TCPView to watch connections in real time.

  • Inspect network bindings and drivers: open Network Connections (ncpa.cpl) → adapter → Properties and uncheck unfamiliar filter/protocol entries temporarily. In Device Manager enable “Show hidden devices” and remove non‑present or suspicious network filter drivers. Autoruns helps find persistent services/drivers.

  • If a security product is suspected, uninstall it cleanly with the vendor’s official removal/cleanup tool, reboot, then reinstall only one AV and test.

If those steps fail, run sfc /scannow, reinstall the NIC driver, and consider restoring to a known good point. Make a restore point or backup before changing drivers or the registry. This sequence narrows a normal‑mode service/driver (firewall, proxy, HIPS or leftover malware filter) that’s blocking outbound updates.

Recommended Answers

All 6 Replies

Member Avatar for Adamsappleone

Have you checked your firewall settings?

Member Avatar for Dragennd

You can change which ports are open and which are closed by going into the firewall settings on your computer.

To do this you simply open up your windows control panel and go to the firewall settings. Then click on exceptions and click add port to tell Windows to allow information to cross through that port in your firewall (of course all this requires admin rights, but I'm assuming you have them). You could also just check the name of the program and Windows will let everything about that program pass through your firewall whatever the port may be.

I don't know anything about those programs but you could go to their website and somewhere on them it should give information about what ports they require for certain actions/uses of the program.

Member Avatar for ladyqueen1988

Check again your FIREWALL SETTINGS. You might have disabled your antivirus ports there.

Member Avatar for Adamsappleone

zoidmaster
going into the firewall settings on your computer.

ladyqueen1988
Check again your FIREWALL SETTINGS.

There must be an echo in here

Member Avatar for Dragennd

Sorry about the echo. If that did not solve your problem then please be a bit more specific in your question. I think I know what your talking about but I'm not sure anymore.

Member Avatar for techsheaven

I assume you've checked windows firewall.

I would uninstall all antivirus/malware/adware programs (if only to resolve the issue) and install comodo Internet Security Suite. It will offer an alternate DNS server. It also shows the status of ports.

Post back here if you do not resolve the issue.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.