Windows Firewall Control (WFC) by BiniSoft.org

Discussion in 'other firewalls' started by alexandrud, May 20, 2013.

  1. aldist

    aldist Registered Member

    Joined:
    Nov 8, 2017
    Posts:
    1,103
    Location:
    Lunar module
    Last edited: Aug 26, 2021
  2. alexandrud

    alexandrud Developer

    Joined:
    Apr 14, 2011
    Posts:
    2,413
    Location:
    Romania
    I will create a backlog story for these additions and will implement them in the future.
    This will not work without a service restart because internally, WFC service will still have value of 2 until it reads again this value. This must be set internally to be updated.
     
  3. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    4,064
    Location:
    Canada
    This may be considered inconsequential, but I've noticed exporting of rules now happens with practically no delay at all. Nice :)
     
  4. alexandrud

    alexandrud Developer

    Joined:
    Apr 14, 2011
    Posts:
    2,413
    Location:
    Romania
    Yes, because the Windows notifications are asynchronous, while the old confirmation dialog was synchronous.
     
  5. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    4,064
    Location:
    Canada
    Ahhh, I thought you might of had a hand in this :D Thanks again, alexandrud!
     
  6. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,168
  7. alexandrud

    alexandrud Developer

    Joined:
    Apr 14, 2011
    Posts:
    2,413
    Location:
    Romania
    The global hotkeys from WFC should be set from WFC user interface. Windows Registry is just a storage place for these settings and you don't have to edit manually Windows Registry to set a global hotkey.
     
  8. AmigaBoy

    AmigaBoy Registered Member

    Joined:
    Sep 12, 2015
    Posts:
    205
    Thank you for the nice 6.7.0.0 update. Just a minor observation - the Windows 10 notification when toggling profiles via hotkey is confusing because of the icon. When switching to Medium filtering the icon is orange (in the notification) and vice versa (green icon when switching to Low). I am guessing this is Windows-related, it seems to use the program's current status just before the switch.

    Another minor issue, which I bypassed by changing the hotkey. I switch between two keyboard languages via Alt+Shift (or AltGr+Shift). When using the second language (Greek), AltGr+E inserts the € character. After setting Ctrl+Alt+E in WFC to toggle profiles this was no longer possible because the profiles were also switched by AltGr+E alone (but not Alt+E).

    This strange issue remains with the new shortcut (Ctrl+Alt+Y), it just doesn't interfere with something else for me. So:

    English input method: works as expected, neither Alt+Y nor AltGr+Y toggle profiles
    Greek input method: Alt+Y: does nothing (good), AltGr+Y toggles profiles (not good)

    When setting the hotkey in WFC, I use English and the left Alt (not AltGr).
     
  9. AmigaBoy

    AmigaBoy Registered Member

    Joined:
    Sep 12, 2015
    Posts:
    205
    I thought the rules are currently sorted in the Rules Panel by creation date already? Or at least, from new (top) to old (bottom)? Anyway, this addition is probably not worth all the extra work if it won't apply to all rules (default, Store etc.)
     
  10. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,168
    Hi @alexandrud
    first thanks a lot for the new features
    just an idea , wfc with an hash control will be very powerfull
    wfc could only notify with a banner or mark in the rules with a hash failure , xxHash and xxHash3 are blazing fast, or other hash engine
    what do you think ?
    thanks Alexandrud
     
  11. alexandrud

    alexandrud Developer

    Joined:
    Apr 14, 2011
    Posts:
    2,413
    Location:
    Romania
    It will be fixed in the next WFC version. I moved the notification sending after verifying the profile is set but the notification can come with a delay if you press repeatedly the same hot key. However, the actual status is in the tray icon, not in the notification.
    I have no solution for this.
    Yes, latest rules are on top of the list but this is not a result of a sort algorithm, it is just a last-in first-out thing.
    This is too advanced for WFC. WFC will have to read and store these hashes somewhere and then compare the stored ones with the current ones when you reopen Rules Panel.
     
  12. aldist

    aldist Registered Member

    Joined:
    Nov 8, 2017
    Posts:
    1,103
    Location:
    Lunar module
    This is easy to determine, enable learning mode in WFC and look at the value of the parameter in the registry.
    Reg Organizer
     
  13. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,168
    @alexandrud
    hi alexandrud
    could store in the same WFC folder , and could check the hashes when the computer is idle or every x hours/days
    mostly the rules are related to programs installed on ssd and with a file size about 20mb - 40 mb , any hash engine will check very quicky and fast
    I think this feature will make WFC a more secure firewall
    try to ask to wilder users
    thanks and take care

    @aldist
    hi
    i will try it , maybe it's better then registry finder
    thanks
     
    Last edited: Sep 1, 2021
  14. Alpengreis

    Alpengreis Registered Member

    Joined:
    Oct 7, 2013
    Posts:
    670
    Location:
    Switzerland
    @mantra

    The thing is, WFC is NOT a firewall, it's just a GUI for Windows Firewall.

    Additionally to the answer from Alexandru (the developer):

    The question is now, would it be good, to add such (and in future maybe more) functionality, which would also blow up WFC more and more ... or it's better to leave it as is. IMHO it has even more than enough functions in current state (for me personally).

    However: I am not against a such hash function - just, for me it's not necessary to have this within the WFC.

    Greetings
     
    Last edited: Sep 1, 2021
  15. Silver_fang

    Silver_fang Registered Member

    Joined:
    Sep 1, 2021
    Posts:
    8
    Location:
    sweden
    Question:
    Is there way of having the option "Accept temporarily, but ask again later" ?

    I remember the days with ZoneAlarm i could do this and loved it... thanks in advance
     
  16. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,126
    Location:
    U.S.A. (South)
    Am i missing something? Doesn't it already allow pass thru if that's the preference for different minutes?
    Or until WFC restarts?
     
  17. Silver_fang

    Silver_fang Registered Member

    Joined:
    Sep 1, 2021
    Posts:
    8
    Location:
    sweden
    Am I missing something?
    https://i.imgur.com/rfLlEgH.png

    It says Block for now and ask me later...
     
  18. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,126
    Location:
    U.S.A. (South)
    @Silver_fang


    Right mouse click/press the 'Allow This Program' on it's right icon-menu opens-select 5 or 10 or 30 or 60 minutes or until WFC restart. Those are your temporaries.

    sshot-2021-09-02-00-26-26.jpg
     

    Attached Files:

    • ttt.jpg
      ttt.jpg
      File size:
      41.1 KB
      Views:
      9
    Last edited: Sep 2, 2021
  19. Silver_fang

    Silver_fang Registered Member

    Joined:
    Sep 1, 2021
    Posts:
    8
    Location:
    sweden
    Oh didn't even know that it worked like that... thanks
     
  20. aldist

    aldist Registered Member

    Joined:
    Nov 8, 2017
    Posts:
    1,103
    Location:
    Lunar module
    How can I add a process that changes its name every time I booting Windows to the notifications exceptions? Like this
    C:\Program Files\URL\link_03ab36.exe
    C:\Program Files\URL\link_2b41mn.exe
    The number of characters in the suffix is always the same.
     
  21. Silver_fang

    Silver_fang Registered Member

    Joined:
    Sep 1, 2021
    Posts:
    8
    Location:
    sweden
    God i wish I had someone directly to talk with when i'm so confused with some of the outgoing connections that pop-up every now and then and im not sure what to make of it (Lack of understanding)

    Anyone know if this is normal:

    https://i.imgur.com/U1LTTP2.png

    How should I be able to know what is safe and not? Sure the "Signed" part I get that it's a legit microsoft linked feature but how would one know if it's being used by something bad?
    Should this request be allowed if im not sure what exactly it does? I do know what explorer.exe is and it's basically the desktop ui however why it would do an outgoing connection im not sure especially while im idling.

    When the whois is just saying akamai is that some kind of hint also?


    Any replies would be appreciated because I know i'm so bad when it comes to this :(
     

    Attached Files:

  22. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,126
    Location:
    U.S.A. (South)
    I am way far from a firewall guru or expert but I always get those same explorer.exe alerts popping up out of the blue on mine too. For the time being I always press the Block Now and Ask Later because I don't see where it has any business trying to connect out either. If it ever gets annoying for me i'll put a rule on it to Always Block period.

    So far it's only on occasion now and then. One's that I keep wrestling with are svchost.exe and I watch them try to monitor when i'm busy tapping a file to move or copy from folder to desktop or folder or folder. Probably nothing but as I said im no expert but it would be nice to know a concrete list of outgoings necessary and just kick the others to a Block Rule and be done with that nonsense for good.
     
  23. Silver_fang

    Silver_fang Registered Member

    Joined:
    Sep 1, 2021
    Posts:
    8
    Location:
    sweden
    But then there is a risk of maybe not getting what one should get?
    I'm not sure but it looks like the news tab where it says weather the icon has changed to a just newspaper icon instead of raining icon or etc could that be connected to it?

    Found also this forum thread;
    https://forum.glasswire.com/t/why-is-windows-explorer-connecting-to-the-internet/7793/10

    The IP is which confuses me, when i do a whois check it just says AKAMAI, which doesn't mean much for me.
    Gah..
     
  24. wat0114

    wat0114 Registered Member

    Joined:
    Aug 5, 2012
    Posts:
    4,064
    Location:
    Canada
    @Silver_fang

    the following is a partial list of what I block without issue:

    Code:
    C:\windows\explorer.exe
    System
    C:\windows\system32\consent.exe
    C:\windows\system32\compattelrunner.exe
    C:\windows\system32\runtimebroker.exe
    C:\windows\immersivecontrolpanel\systemsettings.exe
    C:\windows\system32\sihclient.exe
    C:\program files\mozilla firefox\pingsender.exe
    C:\windows\system32\speech_onecore\common\speechmodeldownload.exe
    C:\program files\windowsapps\microsoft.yourphone_1.21072.160.0_x64__8wekyb3d8bbwe\yourphone.exe
    C:\program files\windowsapps\microsoft.windowsstore_12107.1001.15.0_x64__8wekyb3d8bbwe\winstore.app.exe
    C:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
    My laptop is a Lenovo so I block those processes and a few Intel processes too. The searchapp.exe process you may want to allow if you want to search online.
     
  25. Silver_fang

    Silver_fang Registered Member

    Joined:
    Sep 1, 2021
    Posts:
    8
    Location:
    sweden

    Thanks, really wish Microsoft could have an list of all the processes and tell us what they do and to what IP's they will be connecting to :/
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.