But the staffs in Emsisoft have ever mentioned that Spyshelter FW uses its WFP driver to filter network traffic. If it is just a GUI for windows firewall, why should it use its own driver to filter the traffic?
Emsisoft installs its own firewall driver and Emsisoft Network Filter.
By default, EIS just applies Windows Firewall profile - Trusted, Doman, Public - to global firewall rules.
EIS does not use Windows' built-in WFP (Windows Filtering Platform) or TDI (Transport Driver Interface).
At least that is how I understood some old Fabian Wosar posts about the EIS firewall.
Whereas SpyShelter Firewall uses WFP or TDI; it uses WFP by default.
SpyShelter Firewall is implemented as a Local System service = SpyShelterSrv - just like BiniSoft's Windows Firewall Control.
This, of course, is very easy to test:
- Create Block rule for browser in SpyShelter Firewall.
- Disable Windows Firewall.
- Reboot system (must restart system otherwise WFP\TDI might continue to apply existing policy).
Now, after reboot, Browser is able to freely connect to internet; SSF created and Windows Firewall (WFP\TDI) enforced the Block rule. After disabling Windows Firewall and system reboot - the Block rule for the browser is no longer being enforced by WFP\TDI.
Re-enable Windows Firewall, reboot system (sometimes not required - WFP\TDI quirk) and browser is once again Blocked.