AMON

     

AMON (Antivirus MONitor) is a memory-resident (working in the operating memory after each restart of a computer) file scanning program. Automatic execution of AMON after computer restart is a fundamental defense against malicious code. Quitting AMON is not recommended and should only be done under special circumstances. Execution of two different antivirus monitors (from different developers) is not recommended since it can cause a system crash and, especially on Windows NT systems, might lead to serious problems. Automatic execution of AMON after computer restart can be set in the Security tab of the AMON setup window.

 

AMON is the most important line of antivirus defense. It is critically important to keep it running at all times using the most current version of the virus signature databases. AMON monitors all potentially threatening actions on protected computers such as opening, executing, creating, or renaming files.

AMON is frequently referred to as the antivirus monitor or the “on-access” scanner in contrast to the “on-demand” scanner. (The latter is invoked by user or as a scheduled task.)

 

To execute its tasks AMON requires important system rights. Technically speaking it works on a level of a system driver. As a result compatibility with other services running on a computer need to be checked during installation of NOD32 system. If the test has been completed successfully, AMON is allowed to start automatically after each restart of a computer.


 Important note: The use of more (than one) antivirus monitor is not recommended. Two (or more) antivirus systems may be installed on a computer, but only one antivirus monitor (on-access scanner) should be used at any time.


AMON has three states:

  1. Running and enabled (Loaded in memory and performing on-access scanning).
  2. Running and disabled (Loaded in memory but not performing on-access scanning).
  3. Stopped and disabled (Not loaded in memory).

If AMON is stopped its icon in the main window of the NOD32 Control Center is gray. This state is not recommended since no active on-access antivirus protection is available on the computer. To start AMON, click its icon and the Start button located in the AMON window.


If AMON is loaded in the memory but its scanning is disabled (not a recommended state), its icon is red. To enable AMON, click its icon to open AMON window and click “Resident module (AMON) enabled” check-box. This action will bring AMON’s icon into the normal (recommended) state. To double check AMON’s performance, click AMON icon to open its main window. The main AMON window contains information on the number of scanned files. Have a look at this number and remember it. Then run/stop any application and check the number of scanned files again. If AMON is running properly, the value of the parameter has increased. c


Description of the AMON window

To open the AMON window, click on the AMON icon in NOD32 Control Center main window.

The contents of the AMON window (available buttons) depends on AMON state of execution. The “Resident module (AMON) enabled” checkbox serves to enable or disable AMON’s main function: on-access scanning. This option is only available (it is not grayed out) if AMON is loaded in the operating memory. To load AMON into memory, click the Start button. To unload AMON from memory, click on the Stop button.

Other useful information available in the main AMON window is the statistics on the total number of Scanned, Infected, and Cleaned files. The name of the latest or currently scanned file is also available followed by information on the installed version of the virus database with its released date. Dates are listed in the following format: YYYYMMDD.


To access setup parameters of AMON module click Setup button located in the main AMON window.



Settings

Five tabs: Detection, Methods, Actions, Exclusion, and Security are available. For a detailed description of specific options in each tab, click on appropriate link below.