search

abbodi1406 / KMS_VL_ALL_AIO

Smart Activation Script
GNU General Public License v3.0
8.12k stars 1.08k forks source link

Windows major update remove SppExtComObjHook.dll file #30

Closed collapsealone closed 1 year ago

collapsealone commented 2 years ago

After every Windows major update, the SppExtComObjHook.dll file is removed causing the office license to expire. It has been happening on many pcs for over a year. Any explanation or help? Thanks

abbodi1406 commented 2 years ago

Removed by Windows Defender or the upgrade process itself?

it's not officially installed program to be preserved

WindowsAddict commented 2 years ago

@collapsealone

Enthousiast has done some tests to check this,

Test 1: 19044.1503 upgrade to 22621.1 using ISO (keep all files and apps option on)

Test2: 14393 upgrade to 22621.1 using ISO (keep all files and apps option on)

Results: Results are the same in both conditions. SppExtComObjHook.dll file was present. below registry keys were also present

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe"

Required KMS IP and port entries in the registry were also present.

However, the below keys were removed but these keys are not responsible for activation, they only help in dealing with non-genuine banners if the 32-bit office is installed on 64-bit windows. 

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServiceName /reg:32
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServicePort /reg:32
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /reg:32

TL;DR In major upgrade scenarios, the KMS_VL_ALL auto renewal setup is not affected. but if the 32-bit office is installed on 64-bit windows then you need to rerun the activation.

--

Please share your scenario, so we can replicate the issue.

collapsealone commented 2 years ago

Removed by Windows Defender or the upgrade process itself?

it's not officially installed program to be preserved

Removed by the upgrade process, Windows Defender is disabled.

collapsealone commented 2 years ago

@WindowsAddict

Unfortunately I can say that I have seen this occur in multiple cases.

The deletion always coincides with the windows update. In all cases windows defender is disabled. In all cases Kaspersky Free is enabled, with exception for SppExtComObjHook.dll, and checking logs there is no detection or removal of the file.

It happens on Windows 10 Pro 64bit, both with office 64bit and 32bit.

In domain and non-domain joined users.

Office version: Pro Plus 2019

==================================================================================

What was the base install build? Mostly 17763 (1809), but also subsequent ones.

How upgrade was performed, using ISO or Windows update? Always Windows update

To which build number, the upgrade was performed? It certainly happened in the last four updates, including 19044 (21H2)

What was the Windows edition name? Windows 10 Pro

Do you have any other antivirus besides Windows defender? Defender: disabled Kaspersky Free 21: enabled

Did you make sure that exclusions for C:\Windows\System32\SppExtComObjHook.dll was properly set? Yes

Thank you for your detailed answer. Is there a forum where these tests are reported and discussed? Thank you

WindowsAddict commented 2 years ago

@collapsealone

I've created this scenario, 1809 Pro, Kaspersky free installed (didn't touch windows defender, it gets turned off if another AV is installed) Exclusions set in Kaspersky

Windows updated to 22H2 Files and registries related to activation were present. (Auto renewal was not affected) Only those registry keys were deleted which I mentioned in the previous post.

WindowsAddict commented 2 years ago

https://forums.mydigitallife.net/posts/838808/

This is official forum link for KMS_VL_ALL