FreshClam HTTP Proxy Settings in freshclam.conf

First locate the freshclam.conf used by the failing updater. A manually launched command and the packaged daemon can use different launch options; editing another copy will leave the failure unchanged.

In that active configuration, set the HTTP proxy endpoint and, when required, its account:

HTTPProxyServer http://proxy.example.net
HTTPProxyPort 8080
HTTPProxyUsername proxy-user
HTTPProxyPassword PROXY_PASSWORD

Replace the example values. Omit HTTPProxyUsername and HTTPProxyPassword when the intermediary needs no login. If you are selecting a public endpoint, the HTTP proxy list provides HTTP candidates; the ClamAV CDN’s download policy still applies. The updater must be able to read this file, but a proxy password is not a reason to make it generally readable; grant access to the appropriate administrator and service account.

On the next update attempt, use the error to choose the next check. A refused connection points to reaching the listener; a 407 points to proxy authentication; a denied database download calls for examining the download policy. Read the proxy log alongside the updater's error when available.

Changing the User-Agent is not a general repair for these failures. ClamAV documents that HTTPUserAgent cannot override the agent for updates from the clamav.net CDN.