ClamWin Free Antivirus :: View topic

Posted: Sun May 17, 2015 10:13 am

If I look at the log it says it cannot retrieve information from:
database.clamav.net
If I try to open that site in a browser I can not reach it, nor can I ping to it.

My questions:
1. Can you reach that site? Hence is the site down, or are it my settings.?
2. Is there an alternative for this mirror? I have found a form in ClamWin where I can specify the virus update download site. If there is a working mirror, I can change that and try again.

Posted: Sun May 17, 2015 11:03 am

I have the same problem sometimes--think it is just the mirror(s). I can usually update later.

Regards,

Posted: Sun May 17, 2015 4:52 pm

ClamWin/ClamAV should automatically switch between mirrors if one fails. As Bob said, wait a little awhile and it should work eventually.

Posted: Mon May 18, 2015 5:01 pm

Thank you. I will wait a few days.

I got it after an update from 0.98.6 to 0.98.7.
I presume it has nothing to do with that?
It is an old W2000 system.

Posted: Mon May 18, 2015 5:09 pm

ClamWin should normally get a couple of signature updates from the Clam AV project every day. On rare occasions, however, the Clam AV sigmakers have not developed any signatures for a few days or there can be a problem with the virus submission interface (it's old and cranky!). Most ClamWin users are probably not going to get the latest/greatest malware, so we are still fairly safe on these occasions.

Regards,

Posted: Fri May 22, 2015 4:17 am

It still does not work:

ClamAV update process started at Fri May 22 08:04:09 2015
main.cld is up to date (version: 55, sigs: 2424225, f-level: 60, builder: neo)
WARNING: Can't get information about database.clamav.net: No IP address
WARNING: getpatch: Can't download daily-20444.cdiff from database.clamav.net
WARNING: Can't get information about database.clamav.net: No IP address
WARNING: getpatch: Can't download daily-20444.cdiff from database.clamav.net
WARNING: Can't get information about database.clamav.net: No IP address
WARNING: getpatch: Can't download daily-20444.cdiff from database.clamav.net
WARNING: Can't get information about database.clamav.net: No IP address
WARNING: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...

I got it the first time after a version update
I am working on Windows 2000

Posted: Fri May 22, 2015 4:27 am

Can you revert to the prior version and see if that works okay for you? If you don't have the prior version, you can get it at https://sourceforge.net/projects/clamwin/files/clamwin/ on the web.

Regards,

Posted: Fri May 22, 2015 4:32 am

Make sure ClamWin use is allowed on the LAN and with your firewall.

Posted: Fri May 22, 2015 8:59 pm

Yes. I would check your firewall and make sure nothing is blocking ClamWin/ClamAV. If you use another Anti-virus, make sure you add an exception to the ClamWin directory.

Posted: Sat May 30, 2015 1:00 pm

Trying older versions did not work.

If it is the firewall, then this would be strange since I did not change any settings and I could download before.

Can you download the database by hand somewhere?

Posted: Sat May 30, 2015 1:21 pm

Actually I cannot reach any *.clamav.net somehow.

I am searching, trying to find a solution to this problem, and some answers are for example on www.clamav.net/doc/mirrors-how-to, and opening it with FF gives Server not found. Firefox can't find the server at www.clamav.net. I could reach that location from my computer at work.

I have found out how to download the files by hand. I could do that from another location and then copy them to my W2000 computer.

(I use that computer for some old games. But if I cannot run any protection on it... from now on I won't use the internet anymore on that machine.)

Posted: Sat May 30, 2015 2:59 pm

Because ClamWin only runs off the ClamAV engine, this issue is something we cannot fix. IF you want to download signatures manually, you can do that on their homepage under the download section. If you still need assistance, I would recommend contacting ClamAV support here: https://www.clamav.net/contact.html

Any issues with the engine or database is something ClamWin cannot fix.

Posted: Sat May 30, 2015 5:04 pm

I have done the following which is a bit of a kludge. But it works, and I am only using this old W2000 now and then.

I have another Windows system with ClamWin.
That has no problems downloading the files
Then I copy the db to this machine by means of a thumb drive. Smile

Then I scan.

It's running now.

Posted: Sat May 30, 2015 6:42 pm

And that scan gives the following result:

C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\IV2R4H61\acom[1].png: Worm.Kido-301 FOUND

And I think that worm prevents me to update my virus database.
I got it on the 11th of May. The last day I could update the db correctly.

And of course, I cannot connect to the Kapersky site that holds the exe to remove this annoyance. I think that definitely proofs it. I could not reach the update site because of a virus. The fact that I did an update just before, is sheer coincidence...

Thanks for your support.

Marc

Posted: Sat May 30, 2015 8:45 pm

Kido is the old Conficker worm (Kido, Downadup, Conficker), which was spread by USB originally. Do a web search for Conficker removal tools. There used to be several AVs that had removal tools for it. If ClamWin can detect it but not remove it, try a scan in Windows safe mode. There may also be one or more registry entries that you will have to manually remove.

Malwareybtes free should remove it if you can run it on the machine--it will run in safe mode also. Other removal tools: Dr. Web's Cureit or maybe Trend Micro's Housecall.

Regards.