AMON

AMON (Antivirus MONitor) is a memory-resident (working in the operating memory after each restart of a computer) file scanning program. Automatic execution of AMON after computer restart is a fundamental defense against malicious code. Quitting AMON is not recommended and should only be done under special circumstances. Execution of two different antivirus monitors (from different developers) is not recommended since it can cause a system crash and, especially on Windows NT systems, might lead to serious problems. Automatic execution of AMON after computer restart can be set in the Security tab of the AMON setup window.

AMON is the most important line of antivirus defense. It is critically important to keep it running at all times using the most current version of the virus signature databases. AMON monitors all potentially threatening actions on protected computers such as opening, executing, creating, or renaming files.

AMON is frequently referred to as the antivirus monitor or the “on-access” scanner in contrast to the “on-demand” scanner. (The latter is invoked by user or as a scheduled task.)

To execute its tasks AMON requires important system rights. Technically speaking it works on a level of a system driver. As a result compatibility with other services running on a computer need to be checked during installation of NOD32 system. If the test has been completed successfully, AMON is allowed to start automatically after each restart of a computer.

Important note: The use of more (than one) antivirus monitor is not recommended. Two (or more) antivirus systems may be installed on a computer, but only one antivirus monitor (on-access scanner) should be used at any time.

AMON has three states:

  1. Running and enabled (Loaded in memory and performing on-access scanning).
  2. Running and disabled (Loaded in memory but not performing on-access scanning).
  3. Stopped and disabled (Not loaded in memory).

If AMON is stopped its icon in the main window of the NOD32 Control Center is gray. This state is not recommended since no active on-access antivirus protection is available on the computer. To start AMON, click its icon and the Start button located in the AMON window.

If AMON is loaded in the memory but its scanning is disabled (not a recommended state), its icon is red. To enable AMON, click its icon to open AMON window and click “Resident module (AMON) enabled” check-box. This action will bring AMON’s icon into the normal (recommended) state. To double check AMON’s performance, click AMON icon to open its main window. The main AMON window contains information on the number of scanned files. Have a look at this number and remember it. Then run/stop any application and check the number of scanned files again. If AMON is running properly, the value of the parameter has increased. c

Description of the AMON window

To open the AMON window, click on the AMON icon in NOD32 Control Center main window.

The contents of the AMON window (available buttons) depends on AMON state of execution. The “Resident module (AMON) enabled” checkbox serves to enable or disable AMON’s main function: on-access scanning. This option is only available (it is not grayed out) if AMON is loaded in the operating memory. To load AMON into memory, click the Start button. To unload AMON from memory, click on the Stop button.

Other useful information available in the main AMON window is the statistics on the total number of Scanned, Infected, and Cleaned files. The name of the latest or currently scanned file is also available followed by information on the installed version of the virus database with its released date. Dates are listed in the following format: YYYYMMDD.

To access setup parameters of AMON module click Setup button located in the main AMON window.

Settings

Five tabs: Detection, Methods, Actions, Exclusion, and Security are available. For a detailed description of specific options in each tab, click on appropriate link below.

  • Detection
  • Methods
  • Actions
  • Exclusion
  • Security


AMON Setup - Detection

AMON, the real-time, memory-resident, antivirus scanner, monitors all potentially dangerous actions performed by either the system or the user.

In its default configuration, AMON scans files when they are created, executed, or opened. Changing the default options is not recommended. The default media scanning targets: Diskette, Local, Network should not be changed either.

AMON also scans the boot sector of a diskette on access and shutdown. The latter option is very important if a bootable infected diskette has been left in the diskette drive during shutdown. Disabling this option might result in infection of your computer after its next startup.

To change the list of the extensions of the files to be scanned by AMON, click the Extension button.


AMON Setup - Methods

There are two basic scanning methods supported by NOD32 Antivirus System modules, including AMON:

Signatures - Signature scanning relies on analysis of previously known viruses and their corresponding patterns in a signature database.

Heuristics - Are sophisticated algorithms which allow detection of yet unknown viruses.

NOTICE: Leave both methods enabled to provide the highest level of protection. (Recommended)

The NOD32 heuristic sensitivity has been carefully optimized and the Standard level should be used. Selection of the Deep level may result in an increased number of false alarms.


AMON Setup - Actions

If the real time antivirus monitor (AMON) detects a virus, several alternative scenarios are supported and can be selected using three radio buttons. The default scenario blocks access to the infected file, displays the warning panel, and offers a selection of follow-up actions. These selections are described in the Security Tab.

Alternatively, access to the infected file can be blocked without any offer of further action.

To request cleaning of the infected file, select the “clean automatically” radio button.


AMON Setup - Exclusion

In general, it is not recommended to exclude any files, directories or boot sectors from AMON scanning. However, in certain special cases, this option can be applied.

To exclude an object from AMON scanning:

  1. Click Add

  2. Enter the directory name or Click the Directory or File buttons to select the desired object to exclude
  3. Select permanent or temporary exclusion

If a file or directory has been excluded from scanning temporarily, the exclusion will be disabled after the next reboot of the computer or after manual deletion of the excluded object from the list.

To delete all exclusions, click the Default button. To confirm your selection click Yes.


AMON Setup - Security

Upon virus detection, several possible actions are presented in the virus warning window. Which actions are available to the user can be selected in the Security Tab as follows:

Clean - Attempt to remove the infection, leaving the original file

Delete - Delete the infected file completely

Rename - Rename infected file (the file is still infected, but can no longer be executed)

Exclude - Temporarily exclude the file from scanning

Replace - Replaces an infected boot sector with a clean copy

AMON is a crucial antivirus protection module and, hence, it should be started automatically after system restart. To enable automatic activation of AMON after restart, select the corresponding checkbox.

By default, changes in virus signatures database take effect immediately after the update files have been downloaded. If a particular computer restarts or its connection is terminated after the instant virus database update has been performed, please uncheck the Enable instant virus signatures database update option.

NOTE: Concurrent use of two resident antivirus modules may result in system crashes. Before enabling automatic activation of AMON after restart, make sure no other resident antivirus program is installed and running on your computer!


Extension Editor

The Extension Editor is a special feature and its use is not recommended unless you are an advanced user. The set of file extensions to be scanned is constantly being updated and you are provided with regular updates as needed. Removing any of the default extensions might result in an infection of your computer!

Extensions list

The list of file extensions to be scanned is presented in the main section of the window. Use the scroll bar on the right-hand side of the window to navigate through the list. To highlight an extension, click on it with your mouse.

Buttons

  • OK - Any modifications to the list of extensions must be confirmed using the OK button.
  • Cancel - The Cancel button closes the window and returns control to the Setup tab.
  • Add - To add an extension, click on the Add button, fill out the dialog line, click on OK and confirm by pressing the OK button.
  • Remove - To remove an extension (may result in security threat), highlight it, click on the Remove and OK button.
  • Default - To restore the default set of extensions (recommended) click on the Default and OK button.

Checkboxes

  • Scan extensionless files - This checkbox includes scanning of files with no extension.
  • Scan all files - Select this option to scan all files by default. When this option is selected the Extension Editor reverses the function of the main dialog box: a list of extensions of the files to exclude from scanning can be created in the extension window. In addition, a new checkbox appears allowing exclusion of extension-less files from scanning.


Add new extension

The list of file extensions for AMON to scan are pre-selected, by default, for optimum safety and efficiency. If a new threat requires addition of a new extension, Eset will release a new update. Therefore, in normal use, we do not recommend selecting the option: “Scan all files”, since this would slow down the scanning process unnecessarily.

WARNING! Removal of any default extension is not recommended and could lead to loss or damage of your data.

The Extension Editor window also has options for scanning all files and files with no extension (generally unnecessary).