Windows Firewall Control (WFC) by BiniSoft.org

The only thing that doesn't work is you can't shut off the Windows Firewall for more than ten minutes!

Some online only installers take longer to finish than the set timeout.

 

This does not make any sense. Where is set this timeout? And why would you need to shut down Windows Firewall in the first place?

 

You mean for the specific executables? Yeah I could do that thanks.

---

Also some good news

A very old issue I had reported in here long time ago regarding the audit policy for windows filtering getting reset to no audit, I finally fixed it, was a lingering audit file in "c:\Windows\System32\GroupPolicy\Machine\Microsoft\WindowsNT\Audit\audit.csv" I wiped the entire "c:\Windows\System32\GroupPolicy\Machine\Microsoft\WindowsNT" path as it is on a clean install of windows, and that issue is finally gone, no idea how my config ended in a broken state like that but fixed, got the fix from here.

https://serverfault.com/questions/633928/audit-policy-applied-then-removed-after-each-gpupdate

Didnt take long to find it when I realised was every gp update resetting it.

 

@chrcol

Good to know about this problem. Thanks for sharing!

 

Trying WFC. The only problem so far is that web protection in Emsisoft does not seem to be working. I read that this may be the case. Is there a workaround?

 

I have been using WFC for some time now, and I must say it's quite nice. Thank you! However, I do have two feedbacks to share:

1. I hope there will be improvements in terms of graphics and performance. It would be great to see enhancements in these areas.
2. It would be really helpful to have a feature for bulk rules. For example, the ability to block three processes with just one click or block an entire folder at once.
   

 

WFC does not block or allow any connection. Maybe the web protection in Emsisoft is not working correctly with Windows Firewall itself? Do you see blocked connections in Connections Log for Emsisoft? Did you try to allow them?

 

Thanks for reply. I double checked rules and all connections allowed. Get this in Emsisoft logs often:
"7/7/2023 10:05:46 AM, Block silently" for host "0.r.msn.com", other hosts affected too by workspace "G1111's WS" policy" Don't recall seeing this message with just Windows firewall before. I did get another detection/block with Emsisoft today so apparently is working properly. No additional followup needed. Thanks again.

 

Hi alexandrud, Long long time user here from back in your Binisoft days pre Malwarebytes .
I have just got a new PC which is windows 11 and installed WFC.
I have it currently setup in learning mode while I get all the rules for my usual programs sorted out. Looking at the log files I have noticed that WFC is blocking itself. Should I allow WFC or keep it blocked.
WFC is trying to connect to 192.229.221.95 on port 80 TCP
19/07/2023 09:12:23 | 14748 | Malwarebytes Windows Firewall Control | C:\program files\malwarebytes\windows firewall control\wfc.exe | Block | Out | 192.168.0.10 | 52149 | 192.229.221.95 | 80 | 6 |

Thanks

 

Please take a look here. Even though your specific connection is not related, you can keep it blocked. WFC uses HTTPS when checking for updates, so a rule for remote port 443 on TCP protocol is more useful if you want to be notified if a new version is available. You can also manually check for updates once in a while. It is up to you.

 

Today I've started having an odd issue - the tray client says it can't connect to the service. The service is running but the only way to reconnect it is to stop and restart the service. Wondering if this might be a new issue brought on by an update (Windows). I'm running Windows 11 22621.2066.

 

Windows Update can have an impact. The following solutions were recommended earlier.
Putting wfc.exe and wfcs.exe files into antivirus exceptions.
Delayed Start of the WFC service.
Reinstalling WFC.
Technically you can implement a temporary solution, automate the restart of the wfcs service. Bat-file autostarted via Windows scheduler with 10-15 seconds delay, it kills the service process and after 2-3 seconds starts it.
https://www.wilderssecurity.com/threads/windows-firewall-control-4.347370/page-96#post-2590481

 

Thanks - yeah I did think about automating it but of course engineer brain wants to know why this has started happening and what the root cause is. The WFC event log is full of "Can't connect to Malwarebytes Windows Firewall Control service. The service is not running." so it's obviously trying to connect periodically. Service reports as running.. Weird. Restart the service appears to be less effective than stop, wait a few seconds and start but I may not be allowing enough time for the two to reconnect.

From the application logs I see "Service started successfully." from wfcs - and this is the one automatically happening at boot (it's few mins later till I stop it as I went for a coffee). All entries here are informational and not error..

Seems to me both processes are running without fault - aside from the client thinking the service isn't running (but it is..). I'm running Malwarebytes and defender but i've not had this problem on any of my PCs before..

 

Multiple processes are trying to connect to this IP like svchost.exe, I believe it is related to certificate checking, but I have it blocked.

When I perform a deep cleanup, WFC always stops working, I just reinstall it and restart afterwards to fix it. Give it a shot.

 

So i've uninstalled it and then tried to install.. and then this happened..

 

OK, this is fun - I can't really remove it - the uninstaller now complains the service isn't there and exits and it seems permissions for the files are setup so I can't delete them manually... (the program folder is still there).

In the end I discovered Malwarebytes was preventing me from taking ownership of the Windows Firewall Control folder and therefore I couldn't delete it.. (please update the manual as it doesn't contain this info!). I've now reinstalled... It's running again but I've yet to reboot.

 

If Malwarebytes self-protection is enabled, it will prevent you to delete files inside C:\Program Files\Malwarebytes\*.
The problems that you have are related to NET Framework installation (Windows Update can break it during some failed updates). WFC uses WCF (Windows Communication Foundation) to communicate between wfc.exe to wfcs.exe.

 

Thanks I'll investigate - it's still broken post reboot. Which version of the framework are you using? Edit: looks like v4?

 

WFC is targeting NET Framework 4.5 or later. Try to repair/reinstall NET Framework 4.8.1 on your machine.

 

OK.. having wasted some hours now I can at least impart what I've learnt:

In the end I decided to do an in place install of Windows to resolve any issues I might be having with the OS install. WFC is not on the system and things work.

Few things to note - .NET 4.8 is a component in Windows 11:



By default, it's on. I've imaged my system drive now so I can try stuff out without having to go through an OS install to get back.

At this point if we try and install WFC the exception I posted earlier comes up and the install bombs out. It has however left the binaries in program files and you can't uninstall it... Not good. It's also possible at this point that the firewall is blocking *everything* so it's best to go into windows firewall (MS) and reset to defaults before you try and enable a feature (since it will try and go online).

I suspect I should try enabling 4.8 (but not sure which WCF implementation you've used) before I go anywhere near trying WFC installation.

I'm now on OS 22621.1992 since I couldn't get a later build in ISO format FYI. I'm also tempted to spin up a VM with the OS build and try WFC installation to prove that even on a clean build this goes bang.. If I try Windows Sandbox then it does indeed throw the same exception (but a VM would be a better test).

 

Just ran a clean install in a VM - this is default state (sorry I was wrong):



On the VM the installer worked fine!

 

So continuing to play... I've enabled 4.8 (same as VM default state).

Ran installer, still crashed out.

Decided to run up Visual Studio and attach to the process (hey old habits) and was denied by Malwarebytes. I *quit* that and attached again (works fine) and very strangely enough the installer then did *not* crash out..

Weird. Next I'll try rebooting..

 

...annndd it's broken once again.

If I quit Malwarebytes first and then uninstall WFC it correctly uninstalls and removes it's files.

 

Try install in safe mode. Install with antiviruses disabled.

 

While I investigate this, try to temporarily stop Malwarebytes and install WFC to a different folder than C:\Program Files\Malwarebytes. Try in C:\Program Files\WFC. Malwarebytes self protection may block WFC because latest WFC release has an older certificate than newer versions of Malwarebytes.