hi, this is my first time posting, and i am honestly a dummy with anything to do with updating my computer,so have it set for auto updates..noticed it kicking out errors, and tried to reload the antivirus today..but still got error message:

ClamAV update process started at Mon Aug 08 16:06:17 2011
WARNING: DNS Resolver: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): nonblock_connect: connect timing out (30 secs)
Can't connect to port 80 of host database.clamav.net (IP: 213.165.80.159)
WARNING: Can't read main.cvd header from database.clamav.net (IP: )
Trying again in 5 secs...
ClamAV update process started at Mon Aug 08 16:07:04 2011
WARNING: DNS Resolver: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd):

so what do i do???

thanks much,

Cat

I see similar messages every once-in-a-while on my system, and the problem has always gone away after a while. There could be a problem with Clam's updating system. I suggest you try updating every half hour or so--give it an hour or two like that. If there is still a problem, then delete the files in your ClamWin database folder and try to update--it will take a couple of minutes, but it should work okay. You can watch the progress.

Get back here if nothing works.

Regards,

sorry, i warned you i was a dummy..LOL this has been trying to update like this for last week.. are you asking me to uninstall & reinstall clam win?? or what do you mean by deleting files?

Okay. Since you are a "newby," have you configured ClamWin to update via the internet? If you have not, right click on the ClamWin icon in your system tray, then click Configure ClamWin, then click the Internet Updates tab, then click Enable Automatic Updates. Put in a frequency and a time and make sure, Warn If Virus Database is Out Of Date and Notify About ClamWin Releases are checked. Then click OK. It should update now. An uninstall and a re-install will fix things sometimes, but I'll bet you haven't configured ClamWin for updates.

Get to know your ClamWin preferences options. That's how you can Configure ClamWin (right click system tray icon then Tools--or click the ClamWin desktop option and then select Tools). You should probably change the General Preferences to allow ClamWin to Move Infected Files To Quarantine. You might also want to click the Scheduled Scans configuration tab and set up an automatic scan. I would scan these folders: Windows\System32 and Users.

Also, ClamWin is not a real-time scanner. It is an on-demand scanner that scans when you tell it to (on-demand) or when you have a scheduled scan. An on-demand scanner does not protect you when you are surfing the internet. After you learn to use ClamWin, look into the Clam Sentinel project at https://sourceforge.net/projects/clamsentinel/ on the internet. Sentinel is a small program that lets you use ClamWin as a real-time scanner--as files are put on your computer. However, you will have to learn to configure and use Clam Sentinel too!

Perhaps one day, we will have a ClamWin integrated real-time scanner.

Regards,

thanks so much for your info... I checked and did have the auto updates set right, but did not have a scheduled scan set..so did that..but it did not fix the problem.. here is latest error message just gotten:


ClamAV update process started at Tue Aug 09 14:22:53 2011
WARNING: DNS Resolver: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): nonblock_connect: connect timing out (30 secs)
Can't connect to port 80 of host database.clamav.net (IP: 213.165.80.159)
WARNING: Can't read main.cvd header from database.clamav.net (IP: )
Trying again in 5 secs...
ClamAV update process started at Tue Aug 09 14:23:40 2011


NEXT???? lol

It looks like there is either a problem connecting with the Clam AV update server (ClamWin uses the Clam AV scan engine and signature database), or your computer has a problem connecting to it. I am also using the database.clamav.net to update my machine without any problems, so I suspect the problem is on your machine.

Perhaps your firewall needs to be configured to let ClamWin update, or perhaps some other security software is blocking the updates. What is your setup: firewall name, Windows operating system, any other security software? Some viruses can block AV updates also.

Regards,

I am using windows firewall, win7, and the problem according to the records has been going on since june 11th.. that's really bad looking for me not to check on it sooner... but i now have it set to send me messages when it fails to update..so hopefully i wont let it get this bad again....

by the way, i usually run scans once a month, and the last one was on july 8th.. and it came back clean..so wonder if it is a virus that was not picked up due to not being updated?? just a guess with the limited knowledge i have...lol

Okay. That is just about the same setup I have. There should not be any problem with the Windows 7 firewall.

Did ClamWin update at some time before June 11th? You can check your update logs (right click on ClamWin icon in system tray, click Display Reports, click Virus Database Update Report. You can scroll back (up) to that date--if the 1 megabyte default size limit has not been passed and it has started over, which is probably not the case if you have only been using ClamWin a couple of months.

Check your hosts file to see what it looks like. It can be found in the Windows folder, System 32 subfolder, drivers subfolder, Etc. subfolder, hosts. There is no file extension. To see what it looks like, double click on the hosts file and select to view it with Notepad. If it looks different than my file I have pasted below, "paint" the file with you mouse by going to the beginning, click and then drag the mouse curser down to a page or two. Then right click somewhere on the "paint" and select Copy. Then make a post here on the ClamWin forum and right click with the mouse and select Paste, which will insert the copied file material into your post. The hosts file will block any items (websites) that are listed there. You should not normally have anything there--like mine below.

Regards,


A Paste Of My Hosts File:
# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

oh Bob you lost me.... i can tell you that i have been using clamwin for a couple of years.. but on this system, only about a year... no problems with updates until june 11...it was updating fine

now this is where you lost me... check host files??? ok, maybe figured it out.. i opened explorer, and followed the paths..right??

here is what i found:


Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

hope this is right...

Yes, your hosts file looks the same as mine, so malware has not stopped any updating via that. We don't know for sure though that malware is your problem.

Is there anything particular about June 11, when ClamWin stopped updating? Did you install any new software about that time? Did you get a new internet service? Did you make any hardware changes in your computer? Do you remember any strange behavior of your computer then--sudden blue screen/shutdown, etc.?

Do you have any other scanning software besides ClamWin? If so, does it update okay? If so, do a scan with it. If you don't have any other scanner, download the free version of Malwarebytes Antimalware from https://www.malwarebytes.org/products/malwarebytes_free on the web. Install it, and then update it and run a Quick Scan with it.

That's all for now. We just want to see if you can use another scanner, if you have made any changes in your system, and if you recall anything from around June 11 that might help explain things.

Regards,

yes around that time i did change from internet service providers.. it now is thru a 3rd party "ACN" but still recieved thru Qwest... so that should not have changed anything.. I will install and update the other malware and run scan..thanks for your help..will let you know what if anything found..


regards, Cat

Okay. If you do not find any malware, the problem may be due to your changing ISPs then. They may have a different Domain Name Service setup. But I think you would probably have similar problems with other software that needs updating.

Regards,

I installed and ran full scan with malware you recommended, and report posted below....so do not know what to do about clamwin now..

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7422

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

8/9/2011 9:01:38 PM
mbam-log-2011-08-09 (21-01-3.txt

Scan type: Full scan (C:\|Q:\|)
Objects scanned: 332740
Time elapsed: 1 hour(s), 52 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Okay. Can you update Malwarebytes all right--no problem doing that? If so, then the problem may not be due to malware.

Let me suggest that you delete everything in your ClamWin database directory and then do a manual update. The database directory is in C:\ProgramData\.clamwin\db for Windows 7 computers. Go there in Windows Explorer and delete each file. There should be 4 files: main, daily, bytecode, and mirrors. See if you can update manually after that--ClamWin should rebuild all the files.

The problem started about the time you changed internet service providers. ClamWin is not officially recognized by Windows as a Windows antivirus program, so you might try to tell your ISP about not being able to update, and see if they need to do anything on their end. But then, I don't believe Malwarebytes is recognized either. Anyway, it's worth a shot--you might show them the ClamWin error message:

"WARNING: DNS Resolver: Can't query current.cvd.clamav.net
WARNING: Invalid DNS reply. Falling back to HTTP mode.
Reading CVD header (main.cvd): nonblock_connect: connect timing out (30 secs)
Can't connect to port 80 of host database.clamav.net (IP: 213.165.80.159) "

Regards,

[/u]