Delete a dll from winsxs folder

Just starting out? Need help? Post your questions and find answers here.
boyoss
User
User
Posts: 81
Joined: Fri Feb 05, 2016 10:11 am

Delete a dll from winsxs folder

Post by boyoss »

I want to delete the firewallapi.dll, to prevent user to make change to the firewall, but in the winsxs there is a backup of this dll, in a folder with a very long and strange name, and i'm afraid windows will backup automatically the dll from ther so i want to delete it also from there.
The question is how do i get the name of that strange folder, it must be written somewhere in the registry, isn't it?

Thanks
IdeasVacuum
Always Here
Always Here
Posts: 6426
Joined: Fri Oct 23, 2009 2:33 am
Location: Wales, UK
Contact:

Re: Delete a dll from winsxs folder

Post by IdeasVacuum »

Could it be a hidden folder? Change your system setting so that hidden folders can be seen.
IdeasVacuum
If it sounds simple, you have not grasped the complexity.
User avatar
Keya
Addict
Addict
Posts: 1890
Joined: Thu Jun 04, 2015 7:10 am

Re: Delete a dll from winsxs folder

Post by Keya »

Windows protects files like that for a reason! Do legit security apps actually delete critical Windows files in an attempt to increase security?!? And what happens when that user needs to legitimately make a change to their firewall? They just copy the file back? And you want to use icacls to completely deny file access as well? I've seen that technique used in malware (ie. Execute access was allowed yet interestingly Read wasn't) and it rightfully should set off heuristic warnings from AV. Is this to be a commercial/public app? If you want to do these types of things properly you'll need to use a kernel driver, there's no point trying to butcher everything at usermode level where there's security holes everywhere because you'll never run out of holes to fix, and security is one of the main reasons for the different CPU rings ie user vs kernel, so it's there if that's what you need - sounds like it is, but again... needs a driver. It either sounds like you're writing malware (just playing devil's advocate - i know not everyone calling DeleteFile() is writing malware! lol) or trying to write a security app by completely destroying the security of the system, so if it's the latter i think you need to revise your approach! :)
User avatar
Michael Vogel
Addict
Addict
Posts: 2797
Joined: Thu Feb 09, 2006 11:27 pm
Contact:

Re: Delete a dll from winsxs folder

Post by Michael Vogel »

Boyoss, I am sure, you know, that you can restrict your user's possibilities simply by user profiles.

Sowho should believe you really want to hack your PC to increase security?! So tell us, what you really want and maybe someone will help...
boyoss
User
User
Posts: 81
Joined: Fri Feb 05, 2016 10:11 am

Re: Delete a dll from winsxs folder

Post by boyoss »

Thanks to everyone for the answers, really good idea to build a virus [FACE WITH TEARS OF JOY][FACE WITH TEARS OF JOY] but it's not what I'm trying to do...
I'm building a software for an office, they need to restrict the computers of the secretaries so they can't acces to Internet, only to email and antivirus updates.

So i wrote rules in firewall, but i'm afraid that someone will change them and open the internet browser, and other things.

That's why i want to secure my software, so noone can bypass the protection.

I checked again, the firewallapi.dll in the winsxs folder in my computer is called
x86_networking-mpssvc-svc_31bf3856ad364e35_6.1.7601.17514_none_9c1ba564261ed6a4_firewallapi
It's not in another folder, just in the winsxs folder.

I can delete it, but i don't think it's exactly the same name in every computer, it seems that all the letters "31bf3856ad364e35_6.1.7601.17514_none_9c1ba564261ed6a4" are some special code of my computer, so the question is how do I get the name of the backup file in another computer.

Hope it was clear, and thanks again [WHITE SMILING FACE]️
Fred
Administrator
Administrator
Posts: 18161
Joined: Fri May 17, 2002 4:39 pm
Location: France
Contact:

Re: Delete a dll from winsxs folder

Post by Fred »

This is not a good way to achieve it especially if you are a system admin. Windows provides a lot of way to restrain users access. We don't support such case as we got a lot of problem with PB executable flagged by antivirus for such behaviours. Locked.
Locked