Windows Firewall Control (WFC) by BiniSoft.org

I don't like this idea. I tend to look at the log after something has not worked to see if anything was blocked.

Another example is Microsoft office. It uses a ClickToRun process of a versioned, numbered directory to update itself automatically and it regularly gets blocked when the version changes. Looking at the log I can see it blocked and allow the new version. If it only logged when open I would have to leave to open to catch this and similar things.

For me it takes 1 or 2 seconds to load the log and I can quickly see all entries for the last couple of hours.

 

Agree entirely. I really don't see anything wrong with the current set up.

 

A lot of times I actually like to see what was blocked recently. I agree with the two posts above me. I like it the way it is now. If you wanted to make it where you could clear a check box or something to make it work both ways, I guess it would make both sides happy.

 

Agree with the above users, removing history is bad, I like to be able to see what has been recently blocked, maybe something happened when I stepped away from the computer.

The way it works now is perfect for my needs, I don't see any problems with the load times either, are people really loading 20000+ entries? I only ever display 100, and I frequently "clear logs" manually when everything checks out okay.

 

Exactly same.

 

No, no, no! Strongly no! To solve problems logs need all. Let's leave it as it is.

 

Thank you for your feedback. I will try to integrate this like it was before, just a check box. I found an alternative way of auto receiving updates, without having the same performance problems.

 

I am trying WFC for the first time today. All is working as I would expect, except for one thing - I have set up a rule to allow the Avast Antivirus updater (C:\Program Files\AVAST Software\Avast\setup\instup.exe) to be allowed outbound (any protocol, all ports, any addresses, apply to all programs and services), but WFC is still blocking it.
I can see that the rule has been created; if I click on the connections log and allow it again then WFC identifies it as a duplicate rule.

Please, what do I need to do to allow instup.exe?

 

WFC does not block or allow anything. Windows Firewall does this based on the existing firewall rules. Does this updater work if you use Low Filtering (outbound filtering disabled in Windows Firewall) profile ? If the answer is yes, create a support ticket with Avast and ask them how to allow their updater when outbound filtering is enabled in Windows Firewall. Some software vendors don't like if outbound filtering is enabled in Windows Firewall and their software just refuse to work, even if they have outbound allow rules created for them.

 

Windows Firewall Control v.5.3.0.0

Change log:
- Removed: Obfuscated code was removed in order to avoid false positives.
- Updated: The documentation was updated.

Download location: https://www.binisoft.org/download/wfc5setup.exe
SHA1: bb9f94a6e4d08e7faac0eb210b8db52e2edd75bc
SHA256: ccb97eb89707a334a850db990f3341ea099543ca04b52d4ec70ecf257466ba2a

Thank you all for your support,
Alexandru

So, without obfuscation/hiding the code, keygens appear in a few hours after I make a new release. As a result, I receive fewer donations to support my work. If I chose to hide the code (version 5.1.1.0), antivirus vendors flag WFC as spyware, malware, etc. As a result, I receive hundreds of support email with the same subject "why you have a virus in your program?". Either way, as a developer... just enjoy this new release which is, as always, clean.

 

Got the latest version via the internal updater. No issues here. Thank you very much for the update.

 

Does this affect performance in any theoretical way? And sucks about the piracy thing, but I doubt they would pony up the dough in any case.

 

5.2.0.0
FWIW ~ after updating to 5.2.0.0. I deleted two program rules and lost access to Connections Log. I reinstalled 5.2.0.0 and was able to access Connections Log. I reproduced loss of access to Connections Log after deleting invalid rules.

Spoiler: Unhandled exception

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode)
at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtSubscribe(EventLogHandle session, SafeWaitHandle signalEvent, String path, String query, EventLogHandle bookmark, IntPtr context, IntPtr callback, Int32 flags)
at System.Diagnostics.Eventing.Reader.EventLogWatcher.StartSubscribing()
at WindowsFirewallControl.Views.ConnectionsPanel..ctor()
at WindowsFirewallControl.Common.ViewManager.OpenConnectionsPanel()
at System.Windows.Forms.ToolStripItem.RaiseEvent(Object key, EventArgs e)
at System.Windows.Forms.ToolStripMenuItem.OnClick(EventArgs e)
at System.Windows.Forms.ToolStripItem.HandleClick(EventArgs e)
at System.Windows.Forms.ToolStripItem.HandleMouseUp(MouseEventArgs e)
at System.Windows.Forms.ToolStrip.OnMouseUp(MouseEventArgs mea)
at System.Windows.Forms.ToolStripDropDown.OnMouseUp(MouseEventArgs mea)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ToolStrip.WndProc(Message& m)
at System.Windows.Forms.ToolStripDropDown.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


************** Loaded Assemblies **************
mscorlib
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2115.0 built by: NET47REL1LAST
CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v4.0.30319/mscorlib.dll
----------------------------------------
wfc
Assembly Version: 5.2.0.0
Win32 Version: 5.2.0.0
CodeBase: file:///C:/Program%20Files/Windows%20Firewall%20Control/wfc.exe
----------------------------------------
PresentationFramework
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2634.0
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/PresentationFramework/v4.0_4.0.0.0__31bf3856ad364e35/PresentationFramework.dll
----------------------------------------
WindowsBase
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2634.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/WindowsBase/v4.0_4.0.0.0__31bf3856ad364e35/WindowsBase.dll
----------------------------------------
System.Core
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2634.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll
----------------------------------------
System
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2634.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
PresentationCore
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2634.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_64/PresentationCore/v4.0_4.0.0.0__31bf3856ad364e35/PresentationCore.dll
----------------------------------------
System.Xaml
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2634.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xaml/v4.0_4.0.0.0__b77a5c561934e089/System.Xaml.dll
----------------------------------------
System.Configuration
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2046.0 built by: NET47REL1
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
----------------------------------------
System.Xml
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2612.0 built by: NET471REL1LAST_B
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll
----------------------------------------
System.ServiceProcess
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2046.0 built by: NET47REL1
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.ServiceProcess/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.ServiceProcess.dll
----------------------------------------
System.Runtime.Remoting
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2114.0 built by: NET47REL1LAST
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Runtime.Remoting/v4.0_4.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
----------------------------------------
System.Windows.Forms
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2110.0 built by: NET47REL1LAST
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2046.0 built by: NET47REL1
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System.ServiceModel
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2623.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.ServiceModel/v4.0_4.0.0.0__b77a5c561934e089/System.ServiceModel.dll
----------------------------------------
System.Runtime.Serialization
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2623.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Runtime.Serialization/v4.0_4.0.0.0__b77a5c561934e089/System.Runtime.Serialization.dll
----------------------------------------
SMDiagnostics
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2623.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/SMDiagnostics/v4.0_4.0.0.0__b77a5c561934e089/SMDiagnostics.dll
----------------------------------------
System.ServiceModel.Internals
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2623.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.ServiceModel.Internals/v4.0_4.0.0.0__31bf3856ad364e35/System.ServiceModel.Internals.dll
----------------------------------------
System.IdentityModel
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2623.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.IdentityModel/v4.0_4.0.0.0__b77a5c561934e089/System.IdentityModel.dll
----------------------------------------
PresentationFramework.Aero2
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2046.0 built by: NET47REL1
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/PresentationFramework.Aero2/v4.0_4.0.0.0__31bf3856ad364e35/PresentationFramework.Aero2.dll
----------------------------------------
PresentationFramework-SystemXml
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2046.0
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/PresentationFramework-SystemXml/v4.0_4.0.0.0__b77a5c561934e089/PresentationFramework-SystemXml.dll
----------------------------------------
UIAutomationTypes
Assembly Version: 4.0.0.0
Win32 Version: 4.7.2634.0 built by: NET471REL1LAST_C
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/UIAutomationTypes/v4.0_4.0.0.0__31bf3856ad364e35/UIAutomationTypes.dll
----------------------------------------

************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.

 

Please update to version 5.3.0.0. I have some hardware problems and the files from my machine got messed up. I updated my earlier post.

No, the performance is not affected at all.

 

FWIW ~ before reading re 5.3.0.0. I reinstalled 5.1.1.0. 5.1 was not activated.
I tried to activate 5.1 = No joy. ?

Okay, I've reinstalled 5.3.0.0 + imported rules. 5.3.0.0 was already activated.
5.3.0.0 feels okay, at this time. Thanks

 

To alexandrud
What do you say, if you change the logic of the Learning mode? According to the "old" logic, apps with a DS can not be controlled, and this still puts your OS at some risk, at least, all telemetry will be transmitted:

I think, according to the "new" logic, the WFC should show notifications for all programs and do not create rules automatically (for the "old school", you can do it optional):

This will be a true Learning mode. And you can transfer the Learning mode from Notifications to Profiles:

 

I would say no. What you want is already there under "Display notifications" mode. This will not create new rules automatically, all programs are notified. Just use this mode.
The existing "Learning mode" is for users that always trust digitally signed applications and they would allow them anyway. Notifications are displayed only for unsigned programs. Svchost.exe is unsigned, therefore your concern about telemetry is not valid.
I don't want to transfer the Notifications into the Profiles, since these are two different things.

 

Updated via internal updater

As for the keygen problem can you get the WFC installer "signed" so it won't be flagged by antivirus?

 

Unfortunately, signing the files won't remove the false positives.

 

It most definitely would help lessen them, from hundreds of support emails to a few dozen, but it's not like doing this, then obfuscating code trying to combat piracy would do much anyway.

You said keygens appear in a few hours after a normal release, how many hours does one take for keygens to show up when you did the obfuscated code release? I presume it was also a few hours after.

 

If I'll apply obfuscation methods, it would take a few days so it might not worth the trouble for $10. But If I do this, I have false positives from at least 8 vendors on VirusTotal. Since I can't apply obfuscation because of antivirus vendors, it takes a few hours. The source code is very easy to read on un-obfuscated assemblies. Anyway, I won't invest much time on this anymore, I will concentrate on more important things.

 

Very cool! I was also against your suggestion above by the way ;-)

 

@alexandrud Thanks for the nice software. I hope you get enough people to pay for it I wish i could get you nice tip but i guess if it was easy to check which license your customer accounts created vs a keygen(created ones) you would have done it.
All the best for you

 

I could make the licensing system to be server side, so there will not be any keygen anymore since the licensing code will exist only on the server only. However, then instead of keygens, will appear cracked exe files that will avoid the check for the licenses. If a cracker will recompile the WFC service he could add also malicious code as well. From my point of view, having keygens is less harmful than having cracks. For everyone. So, I will leave it the way it is now and I will concentrate more on new features instead of defeating piracy