Typically, the “connect(): connection refused” error occurs when ClamAV is set to run, but the clamd service isn’t running. Try the following things:
Check to see if clamd is running:
service clamd status
Then restart the service:
service clamd restart
Restart clamd twice. If it shows up as “FAILED” for shutting down clamd each time, then most likely clamd isn’t being restarted properly. Check /var/log/clamav/clamd.log for possible reasons.
When I went in to check on the Anti Virus there was a big red message saying “BECAUSE CLAMAV IS ENABLED, BUT NOT RUNNING, MAIL WILL QUEUE FOR AWHILE…”
This should probably be brought to the webmasters attention from the main NodeWorx panel… possibly using some alert system that identifies problem with subcomponents and sets a flag to the front-end… that would have prevented this problem for me anyway.