AMON Exclusion

I'm trying to keep AMON from scanning files with a .tmp extension, but haven't set it up properly for that. I have tried going into AMON setup/detection/extensions have the check in "scan all files" with ".tmp" added in the exclusion list above that. It still scanned them. Now I've unchecked the "scan all files" and just depend on the default list of extensions to scan (which does not include .tmp). Is that the best way to set this up? (This is on a SBS2003 server with exchange, which is why I want to exclude .tmp) Thanks.

 

You can test it easily - disable AMON, download the eicar test file from http://www.eicar.org/download/eicar.com, rename it to eicar.tmp and finally enable AMON. If tmp extensions are actually excluded, AMON should not throw an alert if you access eicar.tmp

 

Thanks for the tip - that's a helpful tool. My mistake was entering the extension as ".tmp" I should have left off the dot and entered "tmp" That works. Another newbie mistake Thanks for the help.