another Windows Firewall Control?

after quite some digging it seems the delay is due to if you have the default installed rules and run in medium filtering most/all svchost.exe requests are blocked, but windows 7 on startup will try to

HTTP GET http://www.msftncsi.com/ncsi.txt

to figure out if you are connected to the internet or not, and it will think you are not for a little while if you block this initial request. If you allow it it will not do the triangle/spinning circle on startup.

I also enabled the svchost.exe LLMNR udp communication to 224.0.0.252 as win7 does try to use that as well.

With these two rules the startup is the same for medium and low wfc filtering. I don't think you can create a default wfc rule for msftncsi.com because it looks like it's hosted on akamai so everybody will get local (to their isp) addresses for it.

This page explains more about NCSI (and how to disable it if needed) apologies if this is already well known information, it was new to me (but then again as I was saying I don't have a ton of windows experience from a network admin perspective, I am a unix guy by trade )

http://blog.superuser.com/2011/05/16/windows-7-network-awareness/

 

> It seems that a NET update failed to install properly on your system

Possible, but if so, I'm unaware that that happened.

> or another update (or a program that you installed) screwed the system files

Again possible, but again unaware if that were the case.
Generally quite careful what I allow on my system so would think it unlikely, though cannot rule it out.

> if you try WFC on another PC you won't have this problem anymore

Totally don't follow what you're saying here?
Trying on a different PC does nothing to resolve what I'm seeing on this PC.

---

Now ...

Uninstall 3804
Install 3802
Crash
Uninstall 3802
Install 3740
WORKS

Uninstall 3740
Install 3804
Crash
Uinstall 3804
Install 3740
WORKS

Uninstall 3740
Install 3802
Crash

So 3740 works.
With either 3802 or 3804 I crash.

(I had those on hand. Not sure if there were any intervening builds.)

 

Installed, working and activated fine on my Windows 8 laptop (some options almost appear to be missing since my system font size is slightly increased), although on my Windows 7 desktop I get a yellow systray icon and everything in the control panel is greyed out, I'm not able to select anything?

 

I suggested this to see if the same occurs on a different PC too, to see if the problem is on your current PC or if this occurs on multiple computers.

On Windows 8, try to increase the DPI setting instead of the font size. This will increase the size of all components not only for the fonts. You see it wrong, because you increase the font while the window size is still the same. It is normal to see the interface wrong in this case. Use a different DPI setting.
About the Windows 7 computer, you see that yellow mark and the interface is disabled because wfc.exe (GUI) can't communicate with wfcs.exe (service). Did you use the updater or it was a clean install ? Which version do you use ? 3.8.0.4 ?

 

Good News:

I finished the new version and it can be easily translated into any language. At first, from the website, the user will be able to download some available language files. There will be a new "wfc.lng" file which if is copied in the same folder as wfc.exe, when starting WFC, it will load the translated strings from the language file. If this file is not found in the same folder as wfc.exe, the program will be in english as usually. As soon as the default english language file will be translated in another language, the files will be uploaded on the website. The new version will be published in a few days.

Bad News:

I bought a one year digital certificate from Comodo to sign the applications that I develop. From this point started the nightmare:

1. I waited two days and they didn't sent me any confirmation for my order, so I visited their support website and started a live chat with them and they told me that they can't find my order in their system. After 5 minutes of waiting, suddenly, they found it. Now starts the validation.

2. I sent them a copy of my ID and a copy of my last bank account statement. After a few hours I receive an email from them stating that they need to perform a callback verification before they can issue the certificate and they request me to register my phone number under the international phone directory at http://world.192.com

3. I tried without success to register on the websites that appeared on that website. There are two websites for my country. One of them was updated last time 6 years ago and it recommends us to use Internet Explorer 4 for the best view. The company which owns the second website is bankrupt since 2010. It seems that I can't signup on neither of them, so, I sent an email to Comodo and I explained this situation, that I can't signup and is not my fault. I asked them to provide a different solution to validate my identity.

4. They put me on hold without any response and after two days I sent them another email and I asked again to offer me an alternative way to validate my identity or if this is not possible then to refund my money and no problem.

5. After many hours, I receive an email from them in which they insist that I must register my phone number in the phone book in order to be validated. Guess what website they recommend me again ? Yes. The same website of the company that is bankrupt and does not operate anymore.

6. I sent them a new email and I explained again the whole situation. I asked again to provide me an alternative way to validate my identity or if this is not possible, to refund my money so that I can purchase a digital certificate from another company.

7. After one more day, I receive another email from them in which they insist that the phone number verification is mandatory. It seems that I am talking to myself. This is getting really awkward.

8. After 5 days I didn't receive the digital certificate for what I paid for and they have no solution. I wrote them a new email in which I explained again the whole situation and about the fact that they eluded the subject of refunding my money. If they can't provide the product that I paid for and they don't want to refund my money I will have to use the legal way. First is the FTC and if this will not solve this regrettable situation I will sue them.

9. Suddenly, 3 hours later (after 7 days from my purchase) they sent me a new email. They had a solution, but they didn't know about it. They want me to go to a notary and provide them a legal opinion document to verify the phone number. Instead of a refund, now they sent me to a notary to spend more money to get the certificate. This is outrageous. The notary's fee for such a document is more than the cost of the certificate. This is how they understand my situation.

I hope they will enjoy the 75$ I gave them for nothing, because I can't. Shame on you, Comodo.

WFC will be signed further with the same self generated certificate like it was until now. I'm done with all this certificate thing and I don't want to invest (lose) more time and money with this.

In my entire life I never had such a luck when I bought something through the Internet.

 

Ouch, that's really saddening and unfair! You just gonna accept the loss? Doesn't your bank, like PayPal, have some methodology for disputing such unfair act? Cause this really shouldn't be allowed to slide away unnoticed.

If they desperately need to validate your phone number, with today's technology, couldn't a 3 way call simply be made between your Phone Service Provider, you and them in order to verify it?

 

Have you posted your problem at Comodo forum?
There are people that can help in such situations...

 

Screw the digital certificate, and Comodo. All that hassle, what's the use?

 

Seems like you posted a topic in Comodo forums. I added my comment also there:
http://forums.comodo.com/code-signing-certificate/windows-firewall-control-t90317.0.html

 

That situation sounds awful. As much as you may not like considering it at this point, I think your best option would be to post essentially the same message on the Comodo forum in this section. I'm sure this can be sorted out. There's absolutely no reason you should have to waste your money like that.

Please create a new topic in that section, and if a Comodo forum staff member does not reply to it within a 24 hour period please send me a PM and I will contact the CEO of Comodo and direct him to your post.

Thank you.

 

Well, I had an opened support ticket with Comodo, this is why I didn't post on their forum. After 10 days and a lots of emails and a lot of lost time I have contacted their reseller and explained the whole situation and they said that they will refund my money. I expect the money back in 5 days. This was the worst experience with an Internet purchase. And, sadly, from a big and well known company.

 

Version 3.8.1.0 available.
This is the first version available in 2013 and the development goes even further.

What's new:
- New: Added multiple languages support. Visit the following page to find more about the new feature and how it works: http://binisoft.org/wfc.php
- Fixed: "Disable the ability of other programs to add firewall rules" doesn't work until the user opens the first time the main window of the program.
- Fixed: Locking feature didn't work in the previous version.

Regarding the multi language support:
- If you would like to see the program in your language you can download one of the wfc.lng files available on the website.
- You have to copy this file in the installation folder, where the file wfc.exe is located.
- If you restart wfc.exe the new strings will be read from the language file.
- The language file is a plain text file and can be easily translated to any language even with Notepad.
- If this file is not found in the installation folder, then the english language interface is loaded by default.
- The installer, the updater and the uninstaller are not translated. All the other windows and messages are translated.
- This implementation will be updated. In the future, when more language files will be available, I will add a new combobox in WFC to select the language from the program and I will include the language files in the program.

If you have time and you translate the wfc.lng file to a new language, please send it to support@binisoft.org and I will add it to the website.

Download location: http://binisoft.org/download/wfc.exe
MD5: 4b338603743d7214cc9c8bec3bacd2b5

Your feedback is welcome.

Thank you for your help and your support,
Alexandru

 

Great job again, thanks.

Hope you will get your money back from Comodo.
And then forget about the certificate.

I'm going to start the German translation soon.

 

> I have a vague idea that if you try WFC on another PC you won't have this problem anymore.
> Please try this and let me know if this problem persists.

Again, I'm not quite following.
On a different PC, I too would not expect a problem.
(I have not had the opportunity to try on anything else of yet, though I may have access to another, & or will be buying some parts soon...)

Anyhow, since then (https://www.wilderssecurity.com/showpost.php?p=2167356&postcount=1391)...

Windows had some (security) updates to .NET.

Still crashes.

WFC has a new version, 3810.

Still crashes.

 

I can't reproduce this problem on my test systems. Please when you see a new crash, go to Event Viewer. Under Windows Logs there is a subcategory names Application. Check this log to see what is the source of the crash and to see if there is a NET crash, not only a WFC crash. They should appear as errors. Also, you can check the log of WFC. Under Applications and Services Logs there is a subcategory named WFC, but I guess there you won't see anything useful because the program crashes and closes and has no time to write anything to this log.

There is a new version of WFC, but it didn't address your problem because I can't reproduce it, this is why I think there is something wrong with some NET assemblies on your computer which may cause the crash.

Looking forward to hear from you.

 

Version 3.8.1.1 available. Quick fixes.

What's new:
- New: Added support to new strings to be translated, especially for the Activation process.
- Fixed: The language file is not loaded if the program is started from the shortcut because the startup folder is not the same as the program folder. This was fixed.
- Fixed: On uninstallation, after the user presses on the Uninstall button, the checkboxes remain enabled and the user can change the options and can break the uninstall process.

Regarding the multi language support:
- I have uploaded the new language file format that adds more strings that can be translated. Only english and romanian are available at this time.
- I already have new translations for: dutch, czech, spanish, portuguese. They have to be verified and will be uploaded to the website in a few days.

Download location: http://binisoft.org/download/wfc.exe
MD5: 90420c24cd02ddbd0a1b0aa7e23d5267

Thank you for your help and your support,
Alexandru

 

Code:

Application: wfc.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Windows.Markup.XamlParseException
Stack:
   at System.Windows.FrameworkTemplate.LoadTemplateXaml(System.Xaml.XamlReader, System.Xaml.XamlObjectWriter)
   at System.Windows.FrameworkTemplate.LoadTemplateXaml(System.Xaml.XamlObjectWriter)
   at System.Windows.FrameworkTemplate.LoadOptimizedTemplateContent(System.Windows.DependencyObject, System.Windows.Markup.IComponentConnector, System.Windows.Markup.IStyleConnector, System.Collections.Generic.List`1<System.Windows.DependencyObject>, System.Windows.UncommonField`1<System.Collections.Hashtable>)
   at System.Windows.FrameworkTemplate.LoadContent(System.Windows.DependencyObject, System.Collections.Generic.List`1<System.Windows.DependencyObject>)
   at System.Windows.StyleHelper.ApplyTemplateContent(System.Windows.UncommonField`1<System.Collections.Specialized.HybridDictionary[]>, System.Windows.DependencyObject, System.Windows.FrameworkElementFactory, Int32, System.Collections.Specialized.HybridDictionary, System.Windows.FrameworkTemplate)
   at System.Windows.FrameworkTemplate.ApplyTemplateContent(System.Windows.UncommonField`1<System.Collections.Specialized.HybridDictionary[]>, System.Windows.FrameworkElement)
   at System.Windows.FrameworkElement.ApplyTemplate()
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at System.Windows.Controls.DataGridCellsPanel.MeasureChild(System.Windows.UIElement, System.Windows.Size)
   at System.Windows.Controls.DataGridCellsPanel.GenerateChild(System.Windows.Controls.Primitives.IItemContainerGenerator, System.Windows.Size, System.Windows.Controls.DataGridColumn, Int32 ByRef, System.Windows.Size ByRef)
   at System.Windows.Controls.DataGridCellsPanel.GenerateChildren(System.Windows.Controls.Primitives.IItemContainerGenerator, Int32, Int32, System.Windows.Size)
   at System.Windows.Controls.DataGridCellsPanel.GenerateAndMeasureChildrenForRealizedColumns(System.Windows.Size)
   at System.Windows.Controls.DataGridCellsPanel.MeasureOverride(System.Windows.Size)
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at MS.Internal.Helper.MeasureElementWithSingleChild(System.Windows.UIElement, System.Windows.Size)
   at System.Windows.Controls.ItemsPresenter.MeasureOverride(System.Windows.Size)
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at System.Windows.Controls.Control.MeasureOverride(System.Windows.Size)
   at System.Windows.Controls.Primitives.DataGridCellsPresenter.MeasureOverride(System.Windows.Size)
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at System.Windows.Controls.Grid.MeasureCell(Int32, Boolean)
   at System.Windows.Controls.Grid.MeasureCellsGroup(Int32, System.Windows.Size, Boolean, Boolean)
   at System.Windows.Controls.Grid.MeasureOverride(System.Windows.Size)
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at System.Windows.Controls.Border.MeasureOverride(System.Windows.Size)
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at System.Windows.Controls.Control.MeasureOverride(System.Windows.Size)
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at System.Windows.Controls.VirtualizingStackPanel.MeasureOverride(System.Windows.Size)
   at System.Windows.FrameworkElement.MeasureCore(System.Windows.Size)
   at System.Windows.UIElement.Measure(System.Windows.Size)
   at System.Windows.ContextLayoutManager.UpdateLayout()
   at System.Windows.ContextLayoutManager.UpdateLayoutCallback(System.Object)
   at System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()
   at System.Windows.Media.MediaContext.RenderMessageHandlerCore(System.Object)
   at System.Windows.Media.MediaContext.RenderMessageHandler(System.Object)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.Dispatcher.WrappedInvoke(System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.DispatcherOperation.InvokeImpl()
   at System.Threading.ExecutionContext.runTryCode(System.Object)
   at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode, CleanupCode, System.Object)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   at System.Windows.Threading.DispatcherOperation.Invoke()
   at System.Windows.Threading.Dispatcher.ProcessQueue()
   at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.Dispatcher.WrappedInvoke(System.Delegate, System.Object, Int32, System.Delegate)
   at System.Windows.Threading.Dispatcher.InvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   at System.Windows.Application.RunInternal(System.Windows.Window)
   at System.Windows.Application.Run()
   at WindowsFirewallControl.App.Main()

Code:

Faulting application name: wfc.exe, version: 3.8.1.0, time stamp: 0x50f1b608
Faulting module name: KERNELBASE.dll, version: 6.1.7601.17965, time stamp: 0x506dcae6
Exception code: 0xe0434352
Fault offset: 0x000000000000bccd
Faulting process id: 0x215c
Faulting application start time: 0x01cdf1c027406ed9
Faulting application path: E:\Program Files\Windows Firewall Control\wfc.exe
Faulting module path: E:\Windows\system32\KERNELBASE.dll
Report Id: 8c8e9350-5db3-11e2-a330-001966122912

Code:

Fault bucket , type 0
Event Name: CLR20r3
Response: Not available
Cab Id: 0

Problem signature:
P1: wfc.exe
P2: 3.8.1.0
P3: 50f1b608
P4: System.Drawing
P5: 4.0.0.0
P6: 5073c7ec
P7: 445
P8: 97
P9: System.Windows.Markup.XamlParse
P10: 

Attached files:

These files may be available here:
E:\Users\RUBEN\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_wfc.exe_eaa0c294815cf9b227e6f67ede937ce53cb377d0_20e21922

Analysis symbol: 
Rechecking for solution: 0
Report Id: 8c8e9350-5db3-11e2-a330-001966122912
Report Status: 0

Correct, nothing useful.

Yes I understand that.
I was just pointing out that there was no change in behavior with the newer version.

 

> try WFC on another PC

3810 worked.
If it had not & if that PC was set up the same (similarly) to mine, then that might have told us something.

Did purchase some parts, so lets see if I can't get it together by next week, in which case it will be set up, the very same as mine.

 

I'm encountering a bothersome issue on my portable computer (WIN7 PRO X64 Admin account), and I'm looking for a resolution:

Every few seconds I get a notification about the same outgoing connection, and although I always click on a "permanent block" in the notification window, the message returns. The outgoing connection appears to be going to the very same LAN the computer is on.
I am trying to find out a way to block this connection and not to see this notification window again in the current session.

WFC Details:
V. 3.8.0.4 activated
Configuration: medium filtering - high notification

Notification Details:
program: system
source 192.168.106.1:137
remote: 192.168.106.255:137
protocol: udp

Rule Name (probably program generated): NT kernel & system (UDP-out)

I'd appreciate any help on this.

 

set Notifications to Medium.

 

I still want to see the details of all other new notifications.

 

I will check this problem. For now, use Medium Filtering profile. The difference between High and Medium is that on Medium notification level, notifications about svchost.exe and System are not displayed. If you have the rule for Windows Update enabled, I think you are ok. Svchost.exe and System generates a lot of notifications. I will check it.

 

I have a question about high vs medium notifications. Are connections that are displaying a notification under high still being blocked under medium just without a notification display? I tried high for a while but was inundated with the various system and svchost notifications so I went to medium and this stopped, which was good. My question here is if the notifications setting has anything to do with what is being blocked or is it just concerned with what is being displayed as a notification of firewall activity (in other words is it active or passive in terms of firewall activity?)

Regards

 

Alexandru, your license scheme is so generous, I registered a 2nd copy just to say thanks. Hope it offsets a little of your cost.

 

The notification level is reffering only to what is displayed. On Medium level, the notifications for svchost.exe and System are just skipped. But they are still blocked by Windows Firewall.

Thank you.