Windows Firewall Control (WFC) by BiniSoft.org

#4592 continued....after machine restart upon first call WFC 5.4 Rules from tray menu. I get

I click OK (3 times) and then WFC Rules opens okay.
Any comments?

 

Hmm, it seems that something (software, Windows Update) changes the auditing settings in Windows. You can re-enable the auditing by re-setting the notifications system. Just set them to Disabled and back to Display notifications or Learning mode. This would set again the auditing to audit success and failure again. Or from Connections Log, uncheck and check again those two check boxes. It will have the same result.

My Account section is still available for existing registered users. Nothing happens.

Reinstall your Intel HD graphics driver. WFC uses D3D for rendering and your driver seems to be broken.

 

Intel HD Graphics driver sorted.
Thanks

 

Been using just Windows Firewall default for a while since I had issues before. Reinstalled WFC to help keep it alive. New version is wonderful. Thanks for releasing it.

 

Hadn't used WFC in so long I totally forgot about the "do not notify" box you can add stuff. That is just so awesome. I added the stuff that squawks at me for access that has no business talking on the inet in there and no more alerts.

I turned on Learning Mode for a few hours while I went through and loaded everything I use, then turned it back to Display Notifications. Then I weeded out the telemetry from stuff like Nvidia and stuck it in the don't bother me box haha.

 

Hi,

I'm having an issue with WFC I'm wondering if anyone could help. Since updating to the latest version (5.4.0.0) I can't view my connections log in the rules panel. I refresh the list and get "please wait" for ages and nothing loads. Any ideas how I could get my connections log back? Thanks

 

~ did you review User manual > Troubleshooting > Connections Log entries are missing

 

Also, try to uncheck and check again these check boxes, just in case a Windows Update disabled the auditing of the required events of Windows Firewall.

 

hello, thanks for your responses. Sorry but I don't know where the user manual is, could you point me to it. Alexandrud I tried unchecking and checking the boxes but it didn't work. Is there some way to troubleshoot / restore the connections log manually e.g. directly in windows firewall? I could maybe do it there if you take me through the steps. Or any other ideas welcome. Thanks

 

After using PingPlotter for a while, wfcs.exe (5.3.1.0) started to be very busy and did not idle even after I stopped PingPlotter. Only a restart of the service resolved the high usage of CPU issue.

Any idea why this happened?

 

Thanks for that tip. And it is a very familiar annoyance sometimes and not just WFC. Certain Windows functions that I regularly use can sometimes, not often, but disengage due to any number of reasons and a simple disconnect and reconnect like that in Device Manager to a Service will clear it right up.

 

No real news but...

https://forums.malwarebytes.com/topic/235872-wfc/

Maybe worth watching that thread.

 

Let's see and wait... MB bought AdwCleaner and kept it free. They integrated MBAE into MBAM, but they also kept a perpetual beta as free standalone SW... I hope they will do the same with WFC, otherwise I'll move to either Sphinx-soft W10FC or Simplewall.

WFC is better because it works with WF (the rules you see in WFC are the same rules you see in WF), so WFC can work as an anti-tampering by blocking or disabling rules added by other SWs.
W10FC and Simplewall work a bit differently: they create their own rules by using WFP, but these rules are disjoined from WF rules.

Sphinx-soft made a very clear statement about rules precedences:

• to block a connection you just need a blocking rule in either WF or WFP
• to allow a connection you need an allow rule on both WF and WFP

So, you need to set WF to allow any outgoing request and use W10FC/Simplewall to block what you wanna block. Even if an app adds an allow rule in WF, you can block that app by W10FC/Simplewall popup (thus creating a block rule)

 

No idea. Probably a large amount of logged events was causing high load on WFC service, especially when the notifications system is used.

 

This didn't happen in previous versions. Since 5.4.0.0 it happens all the time.

https://gfycat.com/PoshFlawedIberianchiffchaff

Same behavior when opening it from system tray icon (first run).

 

re can't access connections log in wfc: thanks for showing my how to access the user manual bjm. I haven't solved the problem but I'm closer. I looked in event viewer and found I had much fewer administrative logs and 0 security logs. I looked in properties and found security log is disabled with no file path for it. If I don't have any security logs in events viewer they won't show up in wfc. I then opened event viewer as administrative user and all the logs and file paths were there. For while now I've had an administrative account for elevation and a standard user account for normal use, as advised on all the sites for security reasons. So it seems my standard account without elevation has less logs and no security logs in event viewer, so I need to give it access to all the logs so wfc can view them too. This problem only cropped up since I updated to 5.4.0.0 so I don't know whats changed. Any ideas?

 

What did not happen in the previous versions ? The loading bar is set to indeterminate, it does not reflect the actual loading. In version 5.4.0.0. the query for loading the Event Log entries is different to avoid a bug in Windows 10 where Connections Log would return nothing because an invalid entry was encountered. The way WFC loads the entries is a little bit changed.

You don't have to change anything for standard user accounts. The entries are loaded by WFC service which runs under Local System account anyway and has all the required privileges. If you log in as an administrator, do you see entries in the Security event log ? Events with IDs 5157, 5156, etc ? Please check the WFC event log to see if there is logged any error related to this (Troubleshooting section of the user manual).

 

H @ Wilders

I have just started using WFC (Win 10 x 64) so I am not very knowledgeable about firewalls in general and specifically WFC

In the attached image it shows the result of an alert (which I blocked) relating to NT Kernel & system.

Can someone explain what NT Kernel & System is doing making outbound contact and why?

Is it legitimate and should I allow it?

Thank you for your help. Terry

 

It's legitimate, and you should block it.

It's doing "M$" stuff.

 

Hi @ Special

Thanks for your input. It's appreciated.

Terry

 

"M$" stuff ?

https://en.wikipedia.org/wiki/Internet_Group_Management_Protocol
https://en.wikipedia.org/wiki/IGMP_snooping

 

Is there a way to group firewall rules per applications?
Now I have rules about the same application scattered all over the place, difficult to follow /manage.

 

You can sort the rules by path. Just click on the column title

 

Once you sort them, you might want to merge multiple rules where it may be possible to have less rules.