I can't reproduce the issue any more. ☹ Tried to create a new .fp file with another signature and both the files, the old and the new, get parsed properly now. This is a bit spooky. Nevertheless, thank you for your assistance, Richard!

Should I discover the same behavior again, I'll report as soon as possible.

BTW. yes, I don't even have clamd & clamdscan installed so I am pretty sure I had been running clamscan.

On Tue, Apr 20, 2021 at 11:54 AM Pavel Řezníček <pavel.reznicek@evangnet.cz> wrote:

Humm, I’ve restarted my laptop and now the .fp file gets read and the detection gets ignored.

How come I need to restart the machine? Is there any service I could restart instead?

A restart shouldn't be necessary.  Is that behavior repeatable?  Are you sure you're using `clamscan` and not `clamdscan`?

I don't think clamscan uses any service, although clamdscan does. When observing `clamscan --debug ...` or `strace clamscan ...` output, I can see the ".fp" files being loaded each time clamscan is executed.

Maybe have a look at the details of what is actually being executed and the details of that execution?

Good luck!

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml