Windows Firewall Control (WFC) by BiniSoft.org

Like I said, I already used their official uninstaller. It didn’t work.

 

I investigated this and I took steps forward to make WFC compatible with Smart App Control. WFC service works now with Smart App Control. The UI part (wfc.exe) is still blocked but I am working on it. I hope the next WFC version will be fully compliant with Smart App Control from Windows 11.

 

@Azure Phoenix

Oook, sorry - I assumed you meant the official uninstaller which is integrated in the program itself.

Thanks for clarification.

 

It’s fine. I appreciate you were trying to help me. Thank you.

 

I'm running latest version 6.9.2.0. I'm having an issue with creating an allow rule for Citrix Workspace (2307.1) to allow checking for updates. I'm not sure if it's being sandboxed or something else, but the process location is being logged here and it seems to be random (this isn't a normal local disk path - it's more of a system/registry/kernel path):

\device\harddiskvolume4\windows\syswow64\config\systemprofile\citrix\updaterbinaries\1c93a24e-2d62-4274-8c9d-e9710c7191f4\citrixreceiverupdater.exe

Adding a rule here doesn't seem to allow anything. Any ideas? Is this a bug?

 

@zeeter82

WFC-User-Guide (PDF), Page 35:

 

I didn't know that was considered a temp path/folder. Usually, local file paths that are considered temp are %temp%, C:\Windows\Temp, etc. Citrix Workspace isn't exactly some random or obscure app either. I figured there would be a better way to get around this. I guess for now I'll lower the security filter for this one only while checking for updates.

Thanks for your help @Alpengreis

 

An experimental option has been introduced in v6.9.0.0. Write CITRIXRECEIVERUPDATER.EXE in capital letters in "Notifications Exceptions", and permissive rules will be created automatically and without notification for this file located anywhere on the disk, even in several places.
There is no need to change the case of the file name on the disk.

 

For the record, automatic allow rule does not work in 6.9.3.0, which is a bummer consider stupid store apps.

 

Tried it and this isn't working. Still gets blocked with same non-standard file path.

 

@zeeter82

IF the path is always the same you could try the following:

Find out on which device your .EXE is, for example let's us assuming it's on the drive "c" then replace the ...

\device\harddiskvolume4\windows\syswow64\config\systemprofile\citrix\updaterbinaries\1c93a24e-2d62-4274-8c9d-e9710c7191f4\citrixreceiverupdater.exe

... with ...

c:\windows\syswow64\config\systemprofile\citrix\updaterbinaries\1c93a24e-2d62-4274-8c9d-e9710c7191f4\citrixreceiverupdater.exe

and create an allow rule with this path.

ELSE you still have the option which is described in WFC-User-Guide (PDF), page 35.

 

I installed Citrix Workspace on my Windows 11 machine and WFC resolves the path properly from:



to:



Did you change recently any system policies (Group Policy or Windows Registry) related to long paths? WFC uses QueryDosDevice function from kernel32.dll to translate device\harddiskvolumeX to actual volume letter. It seems that in your case this function fails. I wonder if you have this problem only with this software or with others too. Please check WFC log for Event ID 201 which is logged when a path can't be resolved. It would be interesting to see what exception occurs.

 

Running WFC on a VMWare based Windows Server 2019 with about 30 users running on it via RDP at any one time.

The issue is that I cannot get the connections log page to load at all now. I have notification Off because I don't want users seeing them, so my only view is via the connection log. Is there any way to optimize the setup for this environment ?

 

30 users connected through RDP to a Windows Server at once? What is the use case here? Did you check WFC event log to see if there is an error while trying to load the entries? In Security Event log, do you have events for blocked/allowed connections? Is the auditing of these events enabled? Did you increase the default size of Security Event log? Which WFC version are you using?

 

@alexandrud

About my posting ... https://www.wilderssecurity.com/thr...-by-binisoft-org.347370/page-269#post-3132878

It really only seems possible to double open the GUI if the GUI is/wasn't already open.

Gereetings

 

@alexandrud

In the test version 6.9.3.0 I noticed that the Extended Properties column no longer works (empty). Additionally it's also editable (no longer read-only).

Best regards.

 

I was finally able to reproduce and fix this.

Good catch. Also fixed.

Thank you for reporting these problems. They will be included in the official release. I want to fix also the Smart App Control problem until make a new official release.

 

Hi all, I'm a new WFC v6.9.2 user. The problem I'm experiencing is that the WFC icon doesn't load into the taskbar's notification area after login. Thinking that my AV might be blocking WFC, I excluded wfc.exe and wfcs.exe within Kaspersky. That wasn't the solution so I then decided to check the status of the WFC service in Windows Services - I couldn't find any such entry! So I reinstalled WFC, which also did not remedy the problem. HELP would be most appreciated.

 

Since version 6.9.3.0, every time I change this value it keeps resetting to 1 minute.

Anyone else having this happen?

 

@yeL

Here it works correct. So at least it seems no generally bug.

 

In Windows Services Management (services.msc), select Delayed Start for the wfcs service
https://www.wilderssecurity.com/threads/windows-firewall-control-wfc-by-binisoft-org.347370/page-270#post-3142139

 

You're right, thank you. And this

 

Thank you for reporting this. I confirm there is a bug there. It will be fixed in the next release.

 

The service name is "Malwarebytes Windows Firewall Control". If WFC tray icon does not appear automatically, what happens if you manually launch wfc.exe? Does it appear? Do you have the process wfc.exe in Task Manager, but not the tray icon? Please provide more details.