AVG virus definitions won’t update: error 0xE0030004 and connection failures

Fix it now

AVG does not publish a meaning for 0xE0030004, but the five-digit numbers alongside it are Windows internet error codes and those are documented precisely. Read them rather than the AVG number: they tell you whether the connection was reset, the SSL libraries failed to load, or a server asked for a client certificate.

netsh winhttp show proxy
w32tm /query /status
w32tm /resync

1. Check the clock first. Set date, time and time zone automatically, then resync. A clock far enough out breaks certificate validation and nothing will update until it is right.
2. If a proxy is required and netsh winhttp show proxy shows a direct connection, import the browser configuration: netsh winhttp import proxy source=ie.
3. Use AVG’s own repair option from its settings, then retry the update.
4. Note which code appears after each change. A different code means you have moved the problem forward rather than gone in a circle.
5. If nothing changes, remove AVG with AVG Clear in Safe Mode and reinstall from the full offline installer.

/force is not a parameter of w32tm /resync. Given an unrecognised switch, w32tm reports the argument as unexpected, prints its usage block, and never attempts a resynchronisation.

If AVG reports today’s definitions you can stop here. If not, the next section reads the companion codes properly, because they are the part of this that is actually documented.

Why it happens

0xE0030004 is AVG’s own number and AVG does not publish a definition for it that can be reached and checked. That is worth saying rather than glossing over: the article will not tell you what it means. What it will do is read the codes that sit beside it, because those are Windows internet error numbers with published text, and they narrow the problem a great deal.

12031 is ERROR_INTERNET_CONNECTION_RESET, published as “The connection with the server has been reset”. 12044 is ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED, “The server is requesting client authentication”. And 12157 is ERROR_INTERNET_SECURITY_CHANNEL_ERROR, published as “The application experienced an internal error loading the SSL libraries”.

That last one is worth reading carefully, because the field diagnosis and the published text are not the same sentence. In practice 12157 turns up where something is terminating TLS and re-issuing it, or where the machine’s own secure channel configuration is damaged. Microsoft’s published text says the application had an internal error loading the SSL libraries. Both are worth holding: the code tells you the secure channel failed, and what caused it is something you have to prove rather than read off.

0xC00000BB gets attached to this error in a lot of places with a confident-sounding meaning. No reachable Microsoft or AVG page publishes one, so this article does not supply it either. If that is the only number you have, the useful move is to reproduce the failure on a different network and see whether the pattern changes.

Full reference

What the companion codes are published as

What the pattern tells you

Commands worth having open

Proving it is the network, not the product

1. Reproduce the failure on the network where it happens and note the exact code.
2. Move the machine to a different network – a phone hotspot is ideal because it inspects nothing – and try again.
3. If it updates there, the product is fine and the corporate path is the variable. Take the code and both results to whoever owns the gateway.
4. If it fails on both, the fault is local: the clock, the machine’s proxy configuration, or the updater’s own state.
5. Only then remove and reinstall. A reinstall on a machine whose network is broken produces a clean product that fails identically.

When to stop diagnosing and reinstall

• Other machines on the same network update normally and this one does not.
• The clock is correct, the proxy is correct, and the codes do not change between attempts.
• The product’s own repair option has been run and made no difference.
• Definition files are visibly stale by weeks rather than days, which suggests the updater stopped rather than that a single update failed.
• In that case: AVG Clear in Safe Mode, the full offline installer, then reapply the subscription and run an update immediately so you can see whether it worked.

Every code this article covers

Confirm the fix worked

1. An update run from AVG’s interface completes.
2. The definition date the product reports is today rather than the day the problem started.
3. w32tm /query /status shows a recent successful synchronisation.
4. Restart and let the scheduled update run on its own, confirming no error appears.
5. If you changed proxy settings, netsh winhttp show proxy shows what you intended.

Questions people ask about this