Windows Firewall Control (WFC) by BiniSoft.org

Hi,
I get repeated notification popups for a svchost.exe process which is DoSvc in Task Manager. I have a block rule for this service but it is not displayed in the popup and thus the rule seems not to work. Does WFC not identify this service? Is there a workaround for this issue or can this be fixed in WFC?
Thank you very much.

 

It was believed that the rules for the services of the svchost.exe did not work in Windows 10. The DoSvc service can be completely stopped and disabled, this will not even affect the speed of downloading updates.

You can try to specify local network addresses in the rule as a range of IP or CIDR, but there is no certainty that this will help.
You can also add a svchost.exe to notifications exceptions and they will not appear.

 

Still monitoring the situation... trying to discover a few answers instead of more questions

 

Ok, such things are annoying, I know ... good luck!

 

good evening...

Just found this in teh Event viewer and wasnt shure what to make of it..

Event: 911
WFC
System.Threading.Tasks.UnobservedTaskExceptionEventArgs was caught.

Can i ignore this or is that anything i should try to investigate?

Thanks...

 

It works with other services here in Windows 10 Professional 64 bit.

The service cannot be deactivated permanently in the services UI (access denied). I had to deactivate it with registry editor:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DoSvc\\Start
change value to 4

What is the reason that WFC can handle other services but not this one?

 

After a forum search, I found this ...

https://www.wilderssecurity.com/thr...-by-binisoft-org.347370/page-190#post-2804190

 

v6.1.0.0 Error 911 is present.

 

The block rule works for sure. However, WFC code might not detect the rule when searching through the existing rules based on the blocked notification. Please send at support@binisoft.org your full policy (including the block rules) and a screenshot of the notification dialog that you see while you expect it to not be displayed.

Check also the Details tab, not only the General tab. It should provide more details about the problem. If you did not notice anything that does not work as it should, then you can ignore it.

Are you sure you receive this because of the missing files ? Check the Details tab and see the reason.

 

If all three Newtonsoft.Json.dll, mbcut.dll, mbcut32.dll or just one Newtonsoft.Json.dll are deleted, the 911 error occurs once a day at the first boot of the computer, the only difference is in Details.
If the libraries are returned to the program folder, there is no 911 error.

 

Thank you, I will take a look in the code.

 

hy,

i just looked into the details and i think i know whats going on, but would be nice to get it confirmed^^

Spoiler: Details

System.Threading.Tasks.UnobservedTaskExceptionEventArgs was caught.



Exception: System.AggregateException: Ausnahmen einer Aufgabe wurden nicht überwacht (entweder wegen Wartens auf die Aufgabe oder wegen des Zugriffs auf die Ausnahmeeigenschaft. Daher wurde die nicht überwachte Ausnahme vom Finalizer-Thread erneut ausgelöst. ---> System.AggregateException: Mindestens ein Fehler ist aufgetreten. ---> System.Net.Http.HttpRequestException: Fehler beim Senden der Anforderung. ---> System.Net.WebException: Die Verbindung mit dem Remoteserver kann nicht hergestellt werden. ---> System.Net.Sockets.SocketException: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 127.0.0.1:443 bei System.Net.Sockets.Socket.InternalEndConnect(IAsyncResult asyncResult) bei System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult) bei System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception) --- Ende der internen Ausnahmestapelüberwachung --- bei System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context) bei System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar) --- Ende der internen Ausnahmestapelüberwachung --- --- Ende der internen Ausnahmestapelüberwachung --- bei System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification) bei WindowsFirewallControl.Manager.SendUpdates() bei System.Threading.Tasks.Task.Execute() --- Ende der internen Ausnahmestapelüberwachung --- ---> (Interne Ausnahme #0) System.AggregateException: Mindestens ein Fehler ist aufgetreten. ---> System.Net.Http.HttpRequestException: Fehler beim Senden der Anforderung. ---> System.Net.WebException: Die Verbindung mit dem Remoteserver kann nicht hergestellt werden. ---> System.Net.Sockets.SocketException: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 127.0.0.1:443 bei System.Net.Sockets.Socket.InternalEndConnect(IAsyncResult asyncResult) bei System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult) bei System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception) --- Ende der internen Ausnahmestapelüberwachung --- bei System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context) bei System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar) --- Ende der internen Ausnahmestapelüberwachung --- --- Ende der internen Ausnahmestapelüberwachung --- bei System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification) bei WindowsFirewallControl.Manager.SendUpdates() bei System.Threading.Tasks.Task.Execute() ---> (Interne Ausnahme #0) System.Net.Http.HttpRequestException: Fehler beim Senden der Anforderung. ---> System.Net.WebException: Die Verbindung mit dem Remoteserver kann nicht hergestellt werden. ---> System.Net.Sockets.SocketException: Es konnte keine Verbindung hergestellt werden, da der Zielcomputer die Verbindung verweigerte 127.0.0.1:443 bei System.Net.Sockets.Socket.InternalEndConnect(IAsyncResult asyncResult) bei System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult) bei System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception) --- Ende der internen Ausnahmestapelüberwachung --- bei System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context) bei System.Net.Http.HttpClientHandler.GetRequestStreamCallback(IAsyncResult ar) --- Ende der internen Ausnahmestapelüberwachung ---<--- <---

its in german, sorry i could not find a way to change it to english..
anyway, i think this is because WFC cant update itself? or connect to the internet?
Also, if that helps, im using DNSCryptProxy thats why its showing 127.0.0.1 in the LOG..

But it looks like everything is working like it should.. As far as i can tell, nothing got out without my knowledge and nothing got in..

Best Regards

 

Only if you install the English LP (Language Pack en-us), can you switch the interface language of entire Windows between German and English. It is easy.

 

ETA next release? msmpeng.exe and the like creating new paths every update and so frequently is a little PITA.

BTW, my notifications need to be closed manually. Is "Automatically close a notification in 30 seconds" not working or where else can I look into?

TIA!

 

Uncheck - check this option.
Check the registry for this parameter
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{WD2827D4-F8E0-B379-I229-D89D12E4642A}]
"NotificationTimeout"=dword:0000001e
(0000001e = 30sec.)

 

No ETA: Currently I work on other projects with higher priority. Automatically close works if you do not move the mouse over the notification. If you have the cursor over the notification, then the timer is stopped.

 

"NotificationTimeout" did not exist. Added it just now. image. Shall watch the next notification. Thanks!

No ETA noted. Thanks anyway!

Shall look into mouse/cursor/timer when some notification next pops.

 

To speed up the process, take Reg Organizer Portable (any version, without registration), when you click the update check button, it asks for access to the network. If you set the date to 30+ days, then it requests each time you start and every time you close the program.

 

@alexandrud

In some future release, would it be possible to have separate Secure Rules so some can be disabled while others deleted?

Since some unauthorized rules come with a blank group name, for instance Steam spam, perhaps one can check disable/delete against the program path.

For those that come in some group already, then checking disable/delete against the group is no doubt more preferable.

 

Just downloaded. Shall check it out later. Thanks!

 

No. It would create confusion, some will get disabled, some deleted. Secure Rules already creates confusion as it is among many users.

 

@alexandrud

Hi, I have been using WFC for many years and I am very happy.

but I didn't find any news and your plans for the future, do you have any news with WFC and Malwarebytes connections?

And are you working on another project?

 

Natürlich

But I would also like the good news

 

I work mainly on different corporate products for Malwarebytes. Can't say much more about it. I write code

Regarding WFC, it is still supported and a new version will be published probably this or next month. I am the only developer that touches WFC code, but since now I'm working on many other projects I do not have enough free time to update WFC. Anyway, I have in plan a new feature to auto update existing firewall rules after updates that change the path because the version is included in the new path. What a dumb approach if you ask me. I also have in plan to update Biniware Run to improve the UI and to use .NET Core. I also have in plan to migrate WFC to .NET Core at some point in the future, but this requires a larger rewrite of code and takes a lot more time.