It looks that SpyShelter's rules are over the rules of System FW
Is it verified? For example, simplewall firewall, like SpyShelter, uses the Windows Filtering Platform to filter traffic, and the instructions for simplewall read “Simplewall works through WFP (Windows Filtering Platform) capabilities. The simplewall firewall does not change the configuration of the Windows firewall, but the Windows firewall filters have more high priority and processed first. " Although the mechanism of SpyShelter may somehow be implemented differently. Therefore, I asked about the priority: was the Windows firewall and the SpyShelter firewall checked, which of them had priority in connection processing? Just using the Windows firewall you can control some connections that cannot be controlled in the SpyShelter firewall, for example, the thin control svchost.exe. or control of Windows services.
For example, in the logs, I see that the Windows firewall is blocking the outgoing connection for a specific svchost.exe process, or for the Windows service, which I blocked access to the Internet, but in the spyshelter firewall logs I see that this particular svchost.exe process was allowed to connect to or that the service blocked in the Windows firewall received automatic permission to access the Internet in the spyshelter firewall logs. So did this svchost.exe or a service get access to the Internet or not? Depends on which firewall has priority. That's interesting, who has priority.