WAID takes a snapshot of the locations in your Windows 98/98SE system which are used to launch programs automatically on startup. It also monitors certain startup files. If the contents of these locations or files change, WAID suspends Windows' boot and prompts you for an action.

This may be useful if a virus, trojan horse or other such device has primed itself to start next time you reboot. You may not be able to avert infection - but you will at least be alerted to a reconfiguration.

WAID allows you to review the changes to the snapshot, review the new snapshot, shell to DOS, abort the boot, or ignore the changes and allow Windows to continue to boot.

In this way, WAID is an Anomaly and Intrusion Detector for Windows.

WAID also has a "silent mode", which detects possible intrusions as usual, however it does not display anything onscreen. This mode is intended for use in corporate environments, where it may not be desirable to confront the user with an IDS alert.

WAID includes an installation/configuration/uninstallation utility.

Screenshots:

configuration The configuration tool.

in action This shot shows WAID's alert screen.