I want to delete the firewallapi.dll, to prevent user to make change to the firewall, but in the winsxs there is a backup of this dll, in a folder with a very long and strange name, and i'm afraid windows will backup automatically the dll from ther so i want to delete it also from there.
The question is how do i get the name of that strange folder, it must be written somewhere in the registry, isn't it?
Thanks
Delete a dll from winsxs folder
-
- Always Here
- Posts: 6426
- Joined: Fri Oct 23, 2009 2:33 am
- Location: Wales, UK
- Contact:
Re: Delete a dll from winsxs folder
Could it be a hidden folder? Change your system setting so that hidden folders can be seen.
IdeasVacuum
If it sounds simple, you have not grasped the complexity.
If it sounds simple, you have not grasped the complexity.
Re: Delete a dll from winsxs folder
Windows protects files like that for a reason! Do legit security apps actually delete critical Windows files in an attempt to increase security?!? And what happens when that user needs to legitimately make a change to their firewall? They just copy the file back? And you want to use icacls to completely deny file access as well? I've seen that technique used in malware (ie. Execute access was allowed yet interestingly Read wasn't) and it rightfully should set off heuristic warnings from AV. Is this to be a commercial/public app? If you want to do these types of things properly you'll need to use a kernel driver, there's no point trying to butcher everything at usermode level where there's security holes everywhere because you'll never run out of holes to fix, and security is one of the main reasons for the different CPU rings ie user vs kernel, so it's there if that's what you need - sounds like it is, but again... needs a driver. It either sounds like you're writing malware (just playing devil's advocate - i know not everyone calling DeleteFile() is writing malware! lol) or trying to write a security app by completely destroying the security of the system, so if it's the latter i think you need to revise your approach! 

- Michael Vogel
- Addict
- Posts: 2797
- Joined: Thu Feb 09, 2006 11:27 pm
- Contact:
Re: Delete a dll from winsxs folder
Boyoss, I am sure, you know, that you can restrict your user's possibilities simply by user profiles.
Sowho should believe you really want to hack your PC to increase security?! So tell us, what you really want and maybe someone will help...
Sowho should believe you really want to hack your PC to increase security?! So tell us, what you really want and maybe someone will help...
Re: Delete a dll from winsxs folder
Thanks to everyone for the answers, really good idea to build a virus [FACE WITH TEARS OF JOY][FACE WITH TEARS OF JOY] but it's not what I'm trying to do...
I'm building a software for an office, they need to restrict the computers of the secretaries so they can't acces to Internet, only to email and antivirus updates.
So i wrote rules in firewall, but i'm afraid that someone will change them and open the internet browser, and other things.
That's why i want to secure my software, so noone can bypass the protection.
I checked again, the firewallapi.dll in the winsxs folder in my computer is called
x86_networking-mpssvc-svc_31bf3856ad364e35_6.1.7601.17514_none_9c1ba564261ed6a4_firewallapi
It's not in another folder, just in the winsxs folder.
I can delete it, but i don't think it's exactly the same name in every computer, it seems that all the letters "31bf3856ad364e35_6.1.7601.17514_none_9c1ba564261ed6a4" are some special code of my computer, so the question is how do I get the name of the backup file in another computer.
Hope it was clear, and thanks again [WHITE SMILING FACE]️
I'm building a software for an office, they need to restrict the computers of the secretaries so they can't acces to Internet, only to email and antivirus updates.
So i wrote rules in firewall, but i'm afraid that someone will change them and open the internet browser, and other things.
That's why i want to secure my software, so noone can bypass the protection.
I checked again, the firewallapi.dll in the winsxs folder in my computer is called
x86_networking-mpssvc-svc_31bf3856ad364e35_6.1.7601.17514_none_9c1ba564261ed6a4_firewallapi
It's not in another folder, just in the winsxs folder.
I can delete it, but i don't think it's exactly the same name in every computer, it seems that all the letters "31bf3856ad364e35_6.1.7601.17514_none_9c1ba564261ed6a4" are some special code of my computer, so the question is how do I get the name of the backup file in another computer.
Hope it was clear, and thanks again [WHITE SMILING FACE]️
Re: Delete a dll from winsxs folder
This is not a good way to achieve it especially if you are a system admin. Windows provides a lot of way to restrain users access. We don't support such case as we got a lot of problem with PB executable flagged by antivirus for such behaviours. Locked.