Windows Firewall Control (WFC) by BiniSoft.org

Thanks for that aldist.

@lofac: I cannot possibly know what Alex is being paid. OTOH, he certainly wouldn't be working for peanuts. Cashews perhaps, but it still means his pay-scale is on the good side, worth getting out of bed for.

 

The best I got was in just a page earlier: https://www.wilderssecurity.com/thr...-by-binisoft-org.347370/page-172#post-2757103

 

Hello,

I have just learnt about the acquisition by Malwarebytes. I am already a registered user of WFC, so all is good for me, but it seems that on the website, there is no way for new users to purchase the product and become a registered user. I would like to know whether I'm mistaken, and if I'm not, does that imply anything regarding support or any future bug fix for features offered to registered users.

 

Earlier, alexandrud wrote in this forum that he would eliminate the identified serious errors.

 

I will continue to support WFC. Critical bugs will be fixed if they appear. However, new features will not be implemented anymore in WFC. Instead, I will work with Malwarebytes team for their new product.

 

Hi Alexandru,
Busy with business issues lately so would like to say many thanks for creating WFC.
Every success with your new project also

 

I keep getting this message while trying to run Windows Update. I allow it every time but it just keeps coming back

Picture:
https://i.imgur.com/YWBKv3y.png

Any ideas? The filepath is
\device\imdisk0\temp\{79640f5f-3b68-4d2a-9af2-82e6a5ec5e32}\mpsigstub.exe

 

Try add this application to the "Notifications -> Exclude Notifications" list.
Or, to turn off such notifications, do the following:
- for the same application, create a common blocking rule for outgoing connections and DISABLE it;
- in the advanced notifications settings enable this feature: Use disabled rules when searching for matching rules. If a matching disabled rule is found the notifications will not be displayed.

 

It's entirely possible the {79640f5f-3b68-4d2a-9af2-82e6a5ec5e32} is not fixed, it changes every time. So the file path is not constant, and you can't make a rule.

What happens if you just let it be blocked?

 

What happens is that it asks me again the next time I try to update.

\device\imdisk0\temp\{b6725ae4-d21d-47f7-b2c5-267490f3a2f5}\mpsigstub.exe
\device\imdisk0\temp\{cf9ff1db-dc36-4495-9967-9831701c8767}\mpsigstub.exe

It seems you're right, it keeps changing every update. Is there a way for me to whitelist mpsigstub.exe?

 

There is no way unfortunately. Windows Firewall rules are applied per path basis not per process basis. If the path changes, a new rule is required. You can add it to the notifications exceptions list so that you won't be bothered again, or you can temporarily switch to Low Filtering profile and allow it to go online.

 

Is this path in UserSpace? (eg: C:\Users\... or Program Data ?)

I really hate security software that behaves like Malware: ZAM Free is on notice, the last time it updated it did exactly what your problem child is doing.

There is a fix, if it is in UserSpace. Get VoodooShield and set a rule to block everything in whichever Temp folder, like this attached image. If you never want to hear about it again, set the Block action to Silent.

Note that this file is a M$ installer, so some updates may not work--IMHO sometimes not a bad idea.

FWIW, VS and WF/WFC is my total realtime protection: what one misses or can't deal with, the other can. It's all about enumerating Goodness

 

BTW, is it possible to block apps from connecting to a certain domain-name via WFC, like with Little Snitch? And can you tell a bit more about your new job at Malwarebytes, what will you be developing?

https://www.obdev.at/products/littlesnitch/index.html

 

Be interesting to see the mess Malwarebytes make of this.

 

WFC does not support resolving domain names.

 

yes, as always....
Shall I remember Partition magic and Drive Image (of Power Quest); for both tools one floppy was enough....
or DVDshrink? half a floppy was enough (and still +- running on W10)..
and some others I do not recall of

 

In Windows Firewall you can't define firewall rules for domain names, only for IPs or IP ranges. I will start working in one week and I will find out more soon, until then I have no other news.

 

I have the ...

Code:

Reading Security log failed.
   Exception: System.ArgumentException: Der Index 16510 liegt außerhalb des gültigen Bereichs. bei System.Diagnostics.EventLogInternal.GetEntryAt(Int32 index) bei WindowsFirewallControl.Proxy.ProxyServer.GetLogConnections(Int32 logEntries, Int32 direction, Int32 eventId)

too unfortunately.

 

OK thanks. And keep us posted about your work at Malwarebytes, sounds interesting.

 

I've noticed that sometimes the Secure Profile option is automatically disabled, by Windows Update for example. I think the most recent Windows cumulative update also did this (KB4284819) - I'm on Win 10 1709 (16299.492).

 

Next Monday I will start working again and I will take a look.

 

Hello and happy to hear the good news about binisoft.

Yesterday I couldn't left-click on the taskbar icons (volume, battery, wifi) to see info or settings in Windows 10 (1803). Also right-clicking program icons in the task bar wouldn't work. So long story short, I fixed it by unchecking Secure rules and Secure profile in WFC. More specifically, Secure rules, because first I disabled Secure profile and restarted but no joy. Then I disabled Secure rules and restarted for the taskbar to work.

Before disabling the options in WFC, I noticed a firewall error followed by a ShellExperienceHost error in Eventviewer. These two errors occurred successively, and repeatedly:

Code:

Log Name:      Microsoft-Windows-AppModel-Runtime/Admin
Source:        Microsoft-Windows-AppModel-Runtime
Date:          14-Jun-18 7:37:15 AM
Event ID:      35
Task Category: None
Level:         Error
Keywords:      AppContainer
User:          DESKTOP-ABCD\USERABCD
Computer:      DESKTOP-ABCD
Description:
CreateAppContainerProfile failed with error 0x80070005 because it was unable to register with the firewall.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-AppModel-Runtime" Guid="{F1EF270A-0D32-4352-BA52-DBAB41E1D859}" />
    <EventID>35</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000002</Keywords>
    <TimeCreated SystemTime="2018-06-14T11:37:15.797005300Z" />
    <EventRecordID>912</EventRecordID>
    <Correlation ActivityID="{D768F447-0397-0000-8967-69D79703D401}" />
    <Execution ProcessID="5472" ThreadID="6088" />
    <Channel>Microsoft-Windows-AppModel-Runtime/Admin</Channel>
    <Computer>DESKTOP-ABCD</Computer>
    <Security UserID="S-1-5-21-860367813-1122591061-15154029-1001" />
  </System>
  <EventData>
    <Data Name="ErrorCode">2147942405</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-AppModel-Runtime/Admin
Source:        Microsoft-Windows-AppModel-Runtime
Date:          14-Jun-18 7:37:15 AM
Event ID:      21
Task Category: None
Level:         Error
Keywords:      (70368744177664),AppContainer
User:          DESKTOP-ABCD\USERABCD
Computer:      DESKTOP-ABCD
Description:
CreateAppContainerProfile failed for AppContainer onecore\ds\security\gina\profile\profext\appcontainer.cpp Line:1895 microsoft.windows.shellexperiencehost_cw5n1h2txyewy Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy with error 0x80070005.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-AppModel-Runtime" Guid="{F1EF270A-0D32-4352-BA52-DBAB41E1D859}" />
    <EventID>21</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000400000000002</Keywords>
    <TimeCreated SystemTime="2018-06-14T11:37:15.797063800Z" />
    <EventRecordID>913</EventRecordID>
    <Correlation ActivityID="{D768F447-0397-0000-8967-69D79703D401}" />
    <Execution ProcessID="5472" ThreadID="6088" />
    <Channel>Microsoft-Windows-AppModel-Runtime/Admin</Channel>
    <Computer>DESKTOP-ABCD</Computer>
    <Security UserID="S-1-5-21-860367813-1122591061-15154029-1001" />
  </System>
  <EventData>
    <Data Name="ErrorCode">2147942405</Data>
    <Data Name="Context">onecore\ds\security\gina\profile\profext\appcontainer.cpp Line:1895 microsoft.windows.shellexperiencehost_cw5n1h2txyewy Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy</Data>
  </EventData>
</Event>

More info about taskbar not working because of ShellExperienceHost - Taskbar start, notifications, search, wifi, date, battery and volume icons not working

 

Secure Rules in 5.3.x is known to cause problems with Windows 10 -because of the way this OS operates- and that's why you get a warning before enabling it. I would either disable it or use WFC 5.0.2.0 if you want that functionality.

Search the previous posts for more info.

 

Is something like this possible?

Okay so lets say I want to block www.example.com, I could do this with a host file with "127.0.0.1 www.example.com"

But can WFC make just the program block traffic to and from www.example.com while leaving it functional for other connections?

 

Thanks @AmigaBoy
@Special DNS resolution is a different aspect. There's a freeware for that HostsMan · abelhadigital.com. It flushes the dns cache, backup/restores previous host file, doesn't run in the background...everything you'd want. Except it applies to the whole machine - not specific programs.