|
WAID Copyright 2000-2005, Stuart Udall
version 1.12: May 9, 2005
|
WAID takes a snapshot of the locations in your Windows system which are used to launch programs automatically on startup. It also monitors certain startup files. If the contents of these locations or files change, WAID suspends Windows' boot and prompts you for an action. This may be useful if a virus, trojan horse or other such device has primed itself to start next time you reboot. You may not be able to avert infection - but you will at least be alerted to a reconfiguration. WAID allows you to review the changes to the snapshot, review the new snapshot, shell to DOS, abort the boot, or ignore the changes and allow Windows to continue to boot. In this way, WAID is an Anomaly and Intrusion Detector for Windows. WAID also has a "silent mode", which detects possible intrusions as usual, however it does not display anything onscreen. This mode is intended for use in corporate environments, where it may not be desirable to confront the user with an IDS alert. WAID includes an installation/configuration/uninstallation utility.
If you extract the file manually, run WAIDC.EXE to install WAID. To uninstall WAID, run WAIDC.EXE and press the Uninstall button (by pressing Alt-U). Note: WAID uses a small program called STAMP for logging. This file is copied to your \WINDOWS\COMMAND directory during installation.
To configure or reconfigure WAID, at any time, run the program WAIDC.EXE located in the WAID directory. Settings are as follows:
Press Enter to save the settings and complete the installation of WAID. Note: don't place an extension after the snapshot filename. WAID adds an extension automatically.
WAID will detect the first time it runs, issue a message, and continue:
In operation, WAID is completely transparent to both Windows and the user, unless the setup snapshot changes. WAID detects these changes by comparing its setup or 'known good' snapshot with one it generates on-the-fly. If there is any change in the snapshot, WAID will interrupt the boot with a message:
If you ignore the changes, WAID will adopt the new snapshot as its 'known good' snapshot. Note: if alert notification is disabled, no message will be displayed, and Windows will continue to start. This means you are not given a chance to abort the boot. This mode might still prove useful in corporate environments, where presenting a user with an alert might prove as disruptive as a viral infection - they would be calling their "IT person" every time. With alert notification disabled, a log of the possible intrusion is still made; the "IT person" can inspect these regularly (perhaps with an automated scanning mechanism) for trouble. WAID runs before any Windows programs, but after AUTOEXEC.BAT. The diskspace consumed is minimal (around 50k total).
|