Unable to activate: Non Recoverable DNS Error (-9)

[craftxbox]

Hello, This morning after a month of not noticing Malwarebytes had stopped working, I reinstalled it to fix it.
Now, it works as expected, except for the fact that nothing that uses the network will work.
What I've tried:

1. Restarting my computer
2. Flushing the DNS Resolver cache
3. Running Repair with the support tool
4. Reinstalling Malwarebytes
5. Using web activation
6. Disabling the firewall

After looking through the logs that the support tool outputted, I didn't see much out of the ordinary myself, except the parts where the network fails, 

06/07/19	" 16:57:26.202"	4689062	3d44	1564	WARNING	HttpConnection	mb::common::net::HttpConnection::SendRequest	"httpconnection.cpp"	393	"Network error."
06/07/19	" 16:57:26.202"	4689062	3d44	1564	WARNING	HttpConnection	mb::common::net::HttpConnection::LogExceptionDetails	"httpconnection.cpp"	1485	"Exception details: text=DNS error: Non recoverable DNS error while resolving: keystone.mwbsys.com"
06/07/19	" 16:57:26.202"	4689062	3d44	1564	WARNING	LicenseControllerImpl	mb::licensecontrollerimpl::KeystoneImpl::SendKeystoneRequest	"keystoneimpl.cpp"	836	"Received a [-9] response from Keystone. This isn't one of the expected httpStatus returns."

This error appears the exact same (minus the Licence Controller entry) for every network failure it encounters, Telemetry, Update, and Activation.

I've exhausted all of the actions I take when software stops working, and have no clue what the issue could be.
Any help to fix this would be appreciated, as I'm currently without any anti-malware protection. (and yes, windows defender being disabled IS intentional)

mbst-grab-results.zip

[AdvancedSetup]

Hello @craftxbox and

Your topic was moved to the Malware Removal section of the forum as someone has been running hacking tools on this system designed to steal and pirate software. We can assist you in removing said items but cannot guarantee the security of the system. It would really be best to backup your personal data and format the drive and reinstall Windows from a licensed legal copy direct from Microsoft.

If you'd like us to assist you in trying to clean the computer please let me know.

Thank you

Ron

 

[craftxbox]

Would you mind going into detail about what such you found in the log?

[AdvancedSetup]

No, I'm sorry but this is not a training facility. Any user that wants to keep hacked software is certainly able to as it's their own computer but we will not assist users in validating or helping to pirate data.

As said, I can offer to assist in cleaning the computer. Discussions about keeping or allowing hacked software is against policy.

 

[craftxbox]

I guess i should probably remove them, but i really havent a clue of what they are.

[AdvancedSetup]

I don't care about data. We will only remove known threats or hacking tools known to be a threat to the system.

 

[craftxbox]

Yes, i understand i'm just confused/curious about what even the threat is.

[AdvancedSetup]

There is software on the system for stealing software from both Microsoft and Adobe. What they don't tell you is they also infect your system.

 

 

[AdvancedSetup]

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[craftxbox]

malwarebytes scan: https://hastebin.com/gobifigode.sql

adwcleaner scan: https://hastebin.com/obuqosapom.md

I noticed that it detected nicehash 2 as malware, which i sortof understand but not entirely.

FRST.txt Addition.txt

[AdvancedSetup]

Please attach the Malwarebytes and AdwCleaner logs here in text format.

Thanks

 

[craftxbox]

mbamscan.txt adwscan.txt

[AdvancedSetup]

Okay, these do not appear to be installed on the main OS. However please be aware that installation and use can infect the system.

D:\vbox\KMSpico_setup.exe
D:\Downloads\KMSpico10.2.0

The system appears to be used for possibly coding Java, but all of the versions are very old and compromised. Unless it affects the code you're working with I would recommend you update all Java and remove the older versions.

Up to you, but CCleaner is now owned by Avast - don't personally recommend the tool anymore, especially on Windows 10 but again the decision is yours.

You appear to possibly be a more advanced user so I'm going to assume you know how to boot into the Recovery Mode and verify if this file exists or not.

C:\windows\system32\Drivers\679A57C5.sys [2017-07-11] <==== ATTENTION (zero byte File/Folder)

If you need help doing that please let me know though.

 

 

Please run the following fix which will run some routines to check and repair your main drive if issues found and will also check and repair core OS files if invalid.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[craftxbox]

Those KMSPico files no longer exist at this point, so they arent a concern.
I do, indeed, use my system for java programming and will uninstall the old java versions.
CCleaner isnt installed, I'm unsure why it's still saying it is.
679A57C5.sys does appear to be a legitimate file, just with no contents.

FRST hasnt completed yet, however i will reply with the log when it does.

[AdvancedSetup]

Sounds good. Are you able to delete that file then or is it locked?

I'm going to be on the road for a bit but will be back later tonight to check the logs again

 

[craftxbox]

Yup, file deleted fine.

FRST finished its thing, heres the log:Fixlog.txt

Additionally, Windows Defender got re-enabled and immediately started quarantining files, despite exclusions being set to ignore said files (which is why it was disabled in group policy)

[AdvancedSetup]

What files did it quarantine?

 

Please download MiniToolBox save it to your desktop and run it.

Checkmark the following check-boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Devices
• List Users, Partitions and Memory size.
• List Minidump Files
  

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using Reset FF Proxy Settings option Firefox should be closed.

 

[craftxbox]

It, like malwarebytes, gets angry about nicehash being present, but refuses to acknowledge theres an exclusion for it when there is.

The original issue appears to be resolved, however upon running MiniToolBox, it reported this error:

 

Other things i've noticed are that my UAC were reset, and UAC no longer prompts for my password.

[AdvancedSetup]

Are you now able to access the Malwarebytes updates and Activation without an issue?

Please see if the following articles help you to reset UAC to how you want it.

How to Change User Account Control (UAC) Settings in Windows 10
https://www.tenforums.com/tutorials/3577-change-user-account-control-uac-settings-windows-10-a.html

User Account Control: Admin Approval Mode for the Built-in Administrator account
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account

We can ignore the MiniToolbox if DNS is now working for you and you're able to access Malwarebytes sites.

You should be able to disable Windows Defender but I'd highly recommend you let it run and if try setting new exclusions for it as needed. Maybe something was broken and preventing the exclusions from working. Remove current ones. Reboot, then reset the exclusions and see if they stay.

Microsoft is typically very willing to assist with direct support for security reasons, so if Defender is not working as it should they should be able to assist you

Let me know if you need anything else

Thanks

Ron

 

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks