[clamav-users] ClamAV MD5 sum based whitelists (*.fp) don’t work in Ubuntu MATE 20.04.2

[Pavel Řezníček]

I can't reproduce the issue any more. ☹ Tried to create a new .fp file 
with another signature and both the files, the old and the new, get 
parsed properly now. This is a bit spooky. Nevertheless, thank you for 
your assistance, Richard!

Should I discover the same behavior again, I'll report as soon as possible.

BTW. yes, I don't even have clamd & clamdscan installed so I am pretty 
sure I had been running /clamscan./

Dne 20. 04. 21 v 16:55 Richard Graham via clamav-users napsal(a):
> On Tue, Apr 20, 2021 at 11:54 AM Pavel Řezníček 
> <pavel.reznicek at evangnet.cz <mailto:pavel.reznicek at evangnet.cz>> wrote:
>
>     Humm, I’ve restarted my laptop and now the .fp file gets read and
>     the detection gets ignored.
>
>     How come I need to restart the machine? Is there any service I
>     could restart instead?
>
> A restart shouldn't be necessary.  Is that behavior repeatable?  Are 
> you sure you're using `clamscan` and not `clamdscan`?
>
> I don't think clamscan uses any service, although clamdscan does. When 
> observing `clamscan --debug ...` or `strace clamscan ...` output, I 
> can see the ".fp" files being loaded each time clamscan is executed.
>
> Maybe have a look at the details of what is actually being executed 
> and the details of that execution?
>
> Good luck!
>
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20210420/db179ca4/attachment.htm>