Windows Firewall Control (WFC) by BiniSoft.org

Discussion in 'other firewalls' started by alexandrud, May 20, 2013.

  1. alexandrud

    alexandrud Developer

    Joined:
    Apr 14, 2011
    Posts:
    2,097
    Location:
    Romania
    I can't use 3rd party programs that I don't own in to retrieve those IP ranges. Anyway, having this IP range will not solve the reported problem.

    It has nothing to do with the uninstallation step. wfc.exe requires standard user privileges for normal operation. It requires administrative privileges and this is when you see the UAC promt, if:
    - the uninstallation is launched because administrative privileges are required to clean-up the computer of any installation traces.
    - the Windows Firewall Control service does not run. In this case, wfc.exe will require administrative privileges so that it can try to start the service wfcs.exe.
    Your are in the second scenario. You don't have to start the uninstaller to make it work, just launch wfc.exe with administrative privileges from your desktop shortcut. The question here is why the service does not start at Windows start-up?
    1. When you start your computer, if you check the Windows services status, which is the status of Windows Firewall Control service ? I guess it is stopped.
    2. If you set the start-up WFC service to Delayed Start you will create a delay on it's initialization. Have you tried this ?
    3. Another reason why wfcs.exe would not start is a security software (usually antivirus) which may block WFC at Windows start-up. What is your other security software that you use ?
     
    Last edited: Jan 31, 2016
  2. hjlbx

    hjlbx Guest

    @alexandrud

    There is a whole lot going on between Kingsoft WPS and WFC:
    • Frozen notifications
    • High wfcs.exe CPU usage
    • Connections not appearing in Connection Log (even after creating rule via "Browse to create rule")
    • Delete entire Connection Log and no new connections will appear - even after refresh
    • WFC keeps notifying about outbound connections, despite outbound rules already created
    • Connections log will freeze
    • etc
    Example:

    WPS Spreadsheets (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\et.exe All Yes Allow Out 443 TCP
    WPS Spreadsheets (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\et.exe All Yes Allow Out 443 TCP
    WPS Spreadsheets (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\et.exe All Yes Allow Out 80 TCP
    WPS Office Cloud Service (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wpscenter.exe All Yes Allow Out 443 TCP
    WPS Office Cloud Service (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wpscenter.exe All Yes Allow Out 443 TCP
    WPS Presentation (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wpp.exe All Yes Allow Out 443 TCP
    WPS Presentation (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wpp.exe All Yes Allow Out 443 TCP
    WPS Office Expansion tool (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\wtoolex\wpsnotify.exe All Yes Allow Out 80 TCP
    WPS Presentation (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wpp.exe All Yes Allow Out 80 TCP
    WPS Office Expansion tool (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\wtoolex\wpsupdate.exe All Yes Allow Out 80 TCP
    WPS Writer (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wps.exe All Yes Allow Out 443 TCP
    WPS Writer (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wps.exe All Yes Allow Out 443 TCP
    WPS Writer (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wps.exe All Yes Allow Out 80 TCP
    WPS Writer (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wps.exe All Yes Allow Out 80 TCP
    WPS Office Cloud Service (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wpscenter.exe All Yes Allow Out 80 TCP
    WPS Writer (TCP-Out) Windows Firewall Control C:\program files\wps office\10.1.0.5486\office6\wps.exe All Yes Allow Out 80 TCP
     
    Last edited by a moderator: Jan 31, 2016
  3. hjlbx

    hjlbx Guest

    @alexandrud

    SOLVED with @marzametal 's help.

    I create temporary block rule until WFC restarts:

    Windows Explorer (explorer.exe) Temporary Rules C:\windows\explorer.exe All Yes Block Out Any

    However, it appears Windows Explorer is still making connections:

    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50395 23.217.129.26 80 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50394 23.217.129.11 80 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50393 23.67.246.75 80 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50392 23.67.246.81 80 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50391 23.78.241.168 443 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50390 23.78.241.168 443 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50389 23.78.241.168 443 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50388 23.78.241.168 443 TCP
    1/31/2016 6:55:13 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50387 23.78.241.168 443 TCP
    1/31/2016 6:54:46 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50383 131.253.34.230 443 TCP
    1/31/2016 6:54:46 PM 5724 Windows Explorer C:\windows\explorer.exe Out 50382 2a01:111:f004:b0::101 443 TCP

    Or am I mis-interpreting the Connection Log ?
     
    Last edited by a moderator: Jan 31, 2016
  4. bunchuu

    bunchuu Registered Member

    Joined:
    Jan 27, 2016
    Posts:
    5
    thanks, the delayed start up solve the problem. Sorry to bother because I didn't know how to set delayed start up before you suggest it.
    I use Emsisoft AM, Malwarebytes anti exploit, Webroot, Zemana antilogger pro dan MBAM pro.

    And thanks for the support :)
     
  5. marzametal

    marzametal Registered Member

    Joined:
    Mar 19, 2014
    Posts:
    766
    I understand you cannot use 3rd party apps to mould your range settings. It was more of an example that I used to silence some 3rd party apps that kept on making outbound requests without my permission. From a Developer perspective, I see now that this approach is not feasible, since you have to have the app installed to know where it is trying to connect to. However, from a user perspective, it can work; especially for apps that "automatically update signatures/definitions" or periodically "check for updates", along with VPN users.

    Might just be a Windows 10 thing... not sure, look forward to future reading as was interested in swapping from LibreOffice to KingSoft Office due to its support of doc and docx file extensions.

    Are you sure Explorer isn't "just trying to make" connections? eg: Display Recently Blocked Outbound connections is what you are looking at... apologies in advance if you already are.
     
  6. hjlbx

    hjlbx Guest

    Heh, heh... @marzametal... you save me a lot of aggravation. Thanks bro...
     
  7. Alpengreis

    Alpengreis Registered Member

    Joined:
    Oct 7, 2013
    Posts:
    554
    Location:
    Switzerland
    No, I had this already in Win 7 ... However: after you create all the necessary rules for such a program this should be no more a problem anyway (except for new (without rule yet) outbound attempts of course).
     
    Last edited: Jan 31, 2016
  8. clubhouse1

    clubhouse1 Registered Member

    Joined:
    Sep 26, 2013
    Posts:
    1,124
    Location:
    UK
    I've just installed windows 10 home x64...I have a paid version of WFC that always worked fine on Windows 8 x32 Since I upgraded to 10 I can't get it to work, the tray icon is "locked" by that I mean double or right clicking has no effect and uninstalling doesn't work via the programs and features option (in fact it doesn't work using elevated command options) I have to use a combination of Revo and unlocker..Any tips?
     
  9. Alpengreis

    Alpengreis Registered Member

    Joined:
    Oct 7, 2013
    Posts:
    554
    Location:
    Switzerland
    Maybe this could help ...
    http://www.binisoft.org/faq2.php#installation
     
  10. newbino

    newbino Registered Member

    Joined:
    Aug 13, 2007
    Posts:
    460
    Hi, running WFC on Win 7 x64. For some reason it is not registering my choice of Allow for a new application (MiPony setup). I have tried every which way, creating a rule from the rules panel, allowing permanently, single connecting, or timed connection when the pop up windows appears, but no go.
    I have a sense it maybe be connected to a wider problem https://www.wilderssecurity.com/threads/mixed-software-events-maybe-a-hardware-problem.383574/ and I would dearly appreciate any suggestions on how to debug
    Thanks!
     
  11. clubhouse1

    clubhouse1 Registered Member

    Joined:
    Sep 26, 2013
    Posts:
    1,124
    Location:
    UK
    Hi, I tried all those suggestions but they didn't solve the problem..It did come with Mcafee Internet Security 2016 but I'm pretty sure I've fully deleted that by using Revo, Everything file searcher and a through search of the registry..I wish we could still use the "devmgr_show_nonpresent_devices" method that was so useful in Windows 7.
     
  12. Alpengreis

    Alpengreis Registered Member

    Joined:
    Oct 7, 2013
    Posts:
    554
    Location:
    Switzerland
    Is the "Windows Firewall Control Service" (wfcs.exe) running after normal Windows Start? One thing you could try is to set this service to "Delayed start" ...

    Some ideas yet:

    - The Windows Firewall itself is up and running?

    - Sure that no other Software has influence (even to the start (boot) process)?

    - You could try to deactivate other start processes for testing purposes.

    - If you can: how is it if you temporary disable your other AV Software (MC Afee)?

    - Have you the problem with (restricted) User AND your Admin account?

    - Are your HW components ok (Config and Drivers) or could there a problem while booting?

    - Was the install of W10 a clean install or an upgrade? Upgrade COULD be responsible.

    About the "devmgr_show_nonpresent_devices": you should be able to view this via "View" Menu of Device Manager (not really sure about this - also maybe it's not the case in Home version or so) - however: you could give it a try ...
     
  13. Alpengreis

    Alpengreis Registered Member

    Joined:
    Oct 7, 2013
    Posts:
    554
    Location:
    Switzerland
    Have you checked the Connection Log?
    If you have further problem with this you could post here your related rule(s) AND the related Connection Log entry/entries ...
     
  14. Poppey

    Poppey Registered Member

    Joined:
    Nov 23, 2015
    Posts:
    36
    Location:
    Germany
    Hello, I have sometimes same problems with Windows 10 and security software. For example, when I start Windows 10 sometimes the Software AppGuard is not running correctly. The reason is, that the AppGuard Service is not started. Same problem is with GlassWire. But I can solve this problem. I use the Freeware System Explorer 7. In the Software under Services I can see all services that are not running. So I can start the service for AppGuard manually. After that everything works fine. Maybe you have the same problem, that the service for the firewall did not start.
     
  15. clubhouse1

    clubhouse1 Registered Member

    Joined:
    Sep 26, 2013
    Posts:
    1,124
    Location:
    UK
    Hi Alpengreis and Poppey,

    Thanks for the tips and suggestions I tried them all...I should have pointed out its a new HP netbook with all the usual pre-installed bloatware..I did a factory reset and only removed McAfee LiveSafe via programs and features then downloaded McAfee's removal tool run that and reset Windows firewall to default via its panel and restarted. I tried a WFC install again and the problem is still there..Anyway I'll probably wind up buying the McAfee suite...Disappointed because I really liked the simplicity of creating custom rules in WFC along with its snappy alerts.

    Sorry about the weird formatting but edit wont allow me to change it!
     
  16. clubhouse1

    clubhouse1 Registered Member

    Joined:
    Sep 26, 2013
    Posts:
    1,124
    Location:
    UK
    alexandrud this weird..I really do what to keep WFC so I tried again and it installed and the tray icon worked!...I was using it for a few hours responding to the flyouts and adding custom rules with no problems..Restarted several times and it continued to work as expected..Then all of a sudden the tray icon locked, ignored left or right clicks, I've restarted, shutdown and still its frozen, I used net command to make sure its running and get a wfc.exe is already running..What's going on?
     
  17. alexandrud

    alexandrud Developer

    Joined:
    Apr 14, 2011
    Posts:
    2,097
    Location:
    Romania
    It happens on my computer for SQL Server service. Randomly and I do not know either what is causing this. Solution is to also to start manually the service even if it is set to Automatic start-up.
    Thank you Alpengreis for your good points. The reason why the application will fail to do anything (frozen system tray icon) can be:

    1. Antivirus blocks it. But it seems is not your case.
    2. An exception in WFC code or even in the .NET assemblies. Please execute eventvwr.msc (Event Viewer) and check the Application category. Here are logged all errors from all programs. Check if you have errors logged for wfcs.exe or wfc.exe in the Source column. If the answer is positive please export the log (Save All Events As... - button from the right) and send it support@binisoft.org to check it.

    upload_2016-2-7_18-10-52.png

    3. Also check the WFC log and if you see there errors logged around the time when you have this problem, please export this log too and send it to me.

    upload_2016-2-7_18-13-51.png

    Looking forward to hear from you.
     
  18. marzametal

    marzametal Registered Member

    Joined:
    Mar 19, 2014
    Posts:
    766
    Also, to add to the above post... if a user has a program called AppGuard installed, and has "netsh.exe" included in User Space tab with Include Set to "Yes", then profile cannot be changed. This isn't an issue with WFC, just providing an example of how a 3rd party app, used for security purposes can interfere with things Windows is programmed to do. Setting the field to "No" allows for profile change to occur.

    appguard.jpg
     
  19. hjlbx

    hjlbx Guest

    @alexandrud

    Since installing WFC, Reliability Monitor shows the following every day:

    Driver Management concluded the process to install driver nettun.inf_amd64_39a76f4fea741eb0\nettun.inf for Device Instance ID SWD\IP_TUNNEL_VBUS\TEREDO_TUNNEL_DEVICE with the following status: 0x0.
     
  20. alexandrud

    alexandrud Developer

    Joined:
    Apr 14, 2011
    Posts:
    2,097
    Location:
    Romania
    Are you sure this is related to WFC ? In Reliability Monitor do you see wfc.exe of wfcs.exe in the Source column ? WFC does not use any driver. On my computers I do not see any warnings or errors for WFC. Anyone else ?
     
  21. hjlbx

    hjlbx Guest

    @alexandrud

    I have no idea why, all of a sudden, the TEREDO_TUNNEL_DEVICE would install.

    Perplexed...
     
  22. hjlbx

    hjlbx Guest

    @alexandrud

    The Microsoft Teredo Tunneling Driver is loaded on systems that use IPv6.

    It started after install of WFC.
     
  23. marzametal

    marzametal Registered Member

    Joined:
    Mar 19, 2014
    Posts:
    766
    I removed IPv6 crap. Don't need it. Plus, Teredo is a security risk in itself. Kiss it goodbye dude.
     
  24. clubhouse1

    clubhouse1 Registered Member

    Joined:
    Sep 26, 2013
    Posts:
    1,124
    Location:
    UK
    I followed the advice alexandrud gave and looked through the event viewer as he instructed, no WFC anomalies just WFC executed...The strange thing is I've found that two other similar firewalls that give the user control of the Window firewall give me the very same problem!..They install okay but I have no control of their functions!...Its a new HP netbook win Win 10 home x64 with all the usual garbage that HP install including Mccafee Internet Security..I removed that with their uninstall prog and done a very thorough check for left overs and surprisingly all files have gone and just a few reg entries..Other third party firewalls run okay..I think I need to get in touch with HP and as them what gives.

    Footnote...I wish I could remove 10 and go back to 8 but I think the product key is embedded into the UEFI.
     
  25. guest

    guest Guest

    @alexandrud

    Could you add this option from W10FC? http://www.sphinx-soft.com/Vista/wireless.html
    • Mode: Expensive/Insecure Connection - The special mode for Internet connection made over Expensive or Insecure networks, over mobile phone/network or satellite. The mode allows programs marked as "Allow in Mode: Expensive/Insecure Connection" (see "Edit Application") to follow the specified security zones only. All the other programs are blocked (excepting some system vital activities). The mode allows selected only programs access and suppresses other potentially (not required immediately) redundant operations, auto updates, background network operations and so on. (Plus version only)
    Zones would be great as well http://www.sphinx-soft.com/Vista/zones.html
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.