Windows Firewall Control (WFC) by BiniSoft.org

I think i face a bug
started with one of the update
i didn't see any prompt when i set the notification to low
and I see the manage rules windows
all the recent activities windows got the block rules created automatically

Also sometime I cannot open the WFC windows when I open it it will said Visual J# Error...

 

Ok. Everything else is working great. Thanks for all your efforts.

 

So, if I understand correctly, you're saying that after some WFC update, you were no longer getting notifications for certain programs while the notification level was set to "Low" AND rules were automatically being created? If so, that's normal; the low notification level automatically allows (and probably creates a new allow rule for) digitally signed programs, with a valid signature, to access the network/internet and displays notifications only for unsigned programs. If you want to see notifications for all non-system applications that attempt accessing the internet, set the notification level to "Medium".

Sounds like a corrupt installation OR some other program interrupting the start-up. What's the error code?

 

I explain more clearly...
the problem is after I set to low,WFC cannot create the rules to allow any program with digitally signed programs
it will create a blocking rules automatically
also it did not prompt any windows for non-digitally signed programs so it will create a blocking rules for non-digitally signed programs too
2>
WFC have start correctly, the Visual J# error was appear sometime only when I open the WFC windows from notification area

I have try to reinstall WFC but no help...

 

Something is not right. WFC does not create block rules out of nowhere. If a program is digitally signed and you use Low notification level, it will create a generic allow rule on the first attempt of connection of that program. But never block rules. If a program is not signed you will get a new notification, but if that program already has a rule, the notification will not be displayed.

1. Which version of WFC do you use ?
2. Which version of Windows do you use ?
3. What other security products do you use ? Antivirus, antispyware, etc.
4. Do you have "Disable the ability of other programs to add firewall rules" enabled ? If you disable this option, do you see new rules added in Manage Rules window after you execute a program without a rule ?
5. WFC is created in C# (.NET) not J# (Java). I can not see how you could receive such an error from WFC. Can you please post a screenshot of the error ?
6. Please go to Event Viewer (eventvwr.msc). Under "Applications and Service logs" category, there is a subcategory named WFC. Here are logged all errors from WFC. When you are there, on the right panel is a button named "Save all events as...". Use this button to export an *.evtx file and send it to support@binisoft.org to check the log.

 

Yes wfc not creating the blocking rules
but after I setting the low it will creating the blocking rules for digital signed program instead of rules of allowing
because I take a look at the mange rules windows,it showing the blocking rules created by WFC automatically
(before that I do not have this problem,i was found in one days when I was using the program...quite weried)
1.4.1.0.2
2.Windows 8.1 zh-tw Professional X64 with Update 1
3.Avira AntiVirus Pro(but have not install the management windows firewall component)
4.I do not enable the Disable the ability of other programs to add firewall rules
5.it happen before but I can't reproduce now....(maybe I am remeber the wrong name,it may the visual c# error instead of J#
6.I cannot find the subcategory named WFC in Applications and Service logs category....

 

Are you perhaps experiencing the same behavior as me, that WFC itself seems to be doing some signature validation? Every time WFC prompts about a connection I have 2 additional connection attempts from wfc.exe
I'm thinking what happens if you have Notifications set to Low and the check for valid signatures fails because of this?
http://postimg.org/image/n6zxkrcq9/

But again I'm not exactly sure what the connections from WFC are. I haven't allowed them but still Low Notifications seem to work. I've read that Alexandru said it's the OS making the connections but somehow they appear to come from wfc.exe instead. A .NET thing maybe.

 

No My WFC seems didn't doing the signature validation

 

Indeed. I was able to reproduce this. The rules created by the Low notification level are block rules in version 4.1.0.2 instead of allow rules. I will fix this in the next version. Until then, please use Medium notification level.

Those IP addresses are from Akamai Technologies and are not requested by WFC as we are not affiliated to these services. The only IP where WFC should be allowed to connect is 50.87.146.202, but only on manually request for updates. This is our website. Other connection attempts should be blocked, as they are generated by the operating system.

 

Bonjour Alexandrud,


Sorry for my english...

I have a registered account, after uninstalling WFC4 I cannot delete "WFC" in the Windows event viewer, how to do please?



Windows 8.1 64 bits - antivirus Windows Defender

 

To manually delete a custom category from Event Log do the following steps:
1. Run regedit.exe and navigate to the following key: [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog]
2. Delete WFC log folder.
3. Now if you run eventvwr.msc again the category was removed.

 

Thank.

 

Is there anyway WFC can be used for ip addresses only...I had to add some yesterday via the Windows Firewall Wizard however, they were removed if WFC was running...I turned off WFC and went through the Wizard again and they remained after turning WFC back on and showed up on the WFC interface.

 

Hi alexandrud,When I have installed the WFC I didn't see this catalogue folder in event viewer
How do I manual adding it for troubleshoot?

 

The WFC subcategory in Event Viewer is added on installation if it does not exist. It is added through functions provided by the .NET Framework. Please backup your rules, uninstall WFC and then make a clean install from scratch of the latest version. It should add WFC in Event Viewer.

 

Does "Find invalid rules" also look for duplicate rules? It doesnt seem like it. Maybe it should.

 

It finds rules for executable files which are not anymore on the disk. These are considered invalid rules. Duplicate rules are valid rules. Is not that simple to find duplicates rules. Based on which criteria ?

 

May I suggest to re-word ""Find invalid rules" to ""Find orphan rules" ?
"invalid" has the connotation of illegal definition, not a lost association between two related entities.

 

NONO
Find invalid rules not have grammar mistake
also invalid in here was not meaning "not in connotation of illegal definition"
Invalid was an (adj) here, to decript the rules which was not correct format(exist path was not here anymore)

According to Oxford dictionary
invalid(adj)
(Of computer instructions, data, etc.) not conforming to the correct format or specifications.
http://www.oxforddictionaries.com/definition/english/invalid#invalid-2

 

I'll take that as a 'no' then.

 

From what I have seen, only IP's are used in both W7FwAS and WFC. I haven't seen any option to use domain names instead. I do all of my firewall rule mods in the W7F / Advanced Security window, using WFC as an interface only (mostly for the Connections Log). I haven't noticed any rules disappearing because WFC is running, as long as the "Disable the ability..." option is unchecked.

In regards to Wizard, are you referring to clicking on "New Rule" on the right hand side?

 

Hello,

I am having a little issue with WFC

I have installed an SMTP server on a home PC to run my emails.

With WFC switch to NO filtering I can connect to the SMTP server and send/recieve emails. Switching on the filtering to Low or Medium blocks access to sending and recieving emails.

The mail server only has one rule in WFC and that is to allow all protocols etc so I can not see this rule. I have deleted the rule and tried sending/recieving again but it still is being blocked by some other rule.

As there is no logging I can not see what rules are being used to blocked as I try a send and recieve.

Is there something I am missing or could someone shed a light on which system rule might be blocking the connections.

Thanks

 

It's possible to have rules with IPs and Program = Any. Unfortunately it can have undesired reactions, as I reported in this posting ...

https://www.wilderssecurity.com/threads/windows-firewall-control-4.347370/page-39#post-2392388

I hope Alexandru has a fix for this behaviour in next update.

 

What I was trying to do was block certain ip's....For example itunes...Instead of blocking the exe. I was trying to ip block the ip's it uses....I find most of those via fiddler, get the ip's from the address and block them....As for the wizard I meant Windows 7 firewall wizard.....As in, new rule> custom > scope....That allows me to block an ip or a range of ip's (no exe or file needed)....I don't see a way of doing that with WFC....If I use the windows wizard to create the rules with WFC running they don't 'set' I have to turn WFC off, set rule and then turn it back on and they then appear on the WFC GUI

 

Ahhhh gotcha now... I have been doing that for the past 2-3 weeks for various IP's, got a decent list going too...
Wish I could help ya' out... works for me but not for you, that just sucks nuts.

Fancy trying something, just for the hell of it? Apologies in advance if you have already done something like this...
1) Disconnect Internet
2) Export your rules from both W7F and WFC
3) Uninstall WFC and restore default rules in W7F
4) Reboot twice then run a registry cleaner, such as CCleaner or PrivaZer (I think for this issue, I'd pick PrivaZer - along with cleaning pagefile at shutdown through the app)
5) Install WFC 4.1.0.2 (doubt any support can be provided for older versions)
6) Import your rules back into W7F, activate internet and reboot
7) In WFC, untick the "Disable the ability..." option and get out of the program (leave it running in the icon section of taskbar)... Make some more IP dependant rules...

See how that goes... also, what is your UAC setting? Mine is turned off fully (never notify)