Solution Unable to open the script file...?

[TheSaint]

Have you looked at creating an exception for the folder you are compiling in, with the AV?

[TwoBeSeen]

First I want to apologize for my rather rude post. I was in a bad mood due to closing a newly opened bug right away.

In our company we use AV: Trend Micro Office Scan V10.6

Additionally we use Cloud based storage (like DropBox):  https://www.syncplicity.com/ which I now think may also be the source of problems. I can check that, because I think I can unload syncplicity (unlike AV which I cannot unload).

I will report my findings here.

 

I recommend to generate a error message if the problematic file generation fails, because in the current state everything seems ok until the user starts the generated EXE file. The error message "unable to open script file" doesn't lead you directly to AV/dropbox or similar problem sources.

Edited January 12, 2016 by TwoBeSeen

[Jos]

I recommend to generate a error message if the problematic file generation fails, because in the current state everything seems ok until the user starts the generated EXE file. The error message "unable to open script file" doesn't lead you directly to AV/dropbox or similar problem sources.

I am not so sure the script isn't included in the first place, but you are the only one that can verify that by looking at the PE Header for RCDATA/"SCRIPT"  and see if it contains data.

Jos

 

PS:

First I want to apologize for my rather rude post. I was in a bad mood due to closing a newly opened bug right away.

This was my reply in your report:

Have you tried without your Anti Virus switched on?
Either way, please come to our forum to discuss your issue interactively, as I am 99.999% sure this is not a bug.

Jos

I would say it is pretty mild with an open invitation to come here for a dialog so your first post is totally unjustified and would recommend finding another way to cool down before posting to ensure your emotions don't take over.

 

[water]

I have the same problem here. Tried a simple "MsgBox(0, ""; "Hello World")" script:

• Tested with AutoIt 3.3.12.0 and 3.3.15.0
• No problem when compiled for 64 bit
• Above error message when compiled for 32 bit
• File size changes between 637kb when it doesn't work and 640 kb when it works
• After trying it 5 to 10 times the script compiles correct and runs without error message
• Excluded aut2exe.exe and Autoit3.exe as well as directory %LocalAppData%\AutoIt v3 from Trend Micro

But still get the same "unable to open script file" error message.

Which tool do I need to check the PE Header for RCDATA/"SCRIPT"?

[Jos]

Which tool do I need to check the PE Header for RCDATA/"SCRIPT"?

I use "CFF Explorer" but you can also use reshacker.

Jos

[water]

Thanks, will check tomorrow.

[water]

This is a Reshacker screenshot of a working script with section RCData/Script present:

and a screenshot of a non working script with a lot of sections missing:

[water]

Problem solved!
Behavior Monitoring has to be disabled for Aut2Exe.exe.

[Jos]

So it does look like the script get removed at "compilation" time and you don't get any error from aut2exe? 
It could be that it is removed right after it was added an aut2exe is unaware of it being removed.

Jos

Edited January 13, 2016 by Jos

[water]

No error messages from aut2exe. Trend Micro as well wasn't configured to log those actions (by default?).
I'm an ordinary user in this respect and was glad that our AV guys had a look and finaly a solution for this problem.
So this is a documentation for future users facing the same problem
 

[TheDcoder]

It happens in Avast too..., It blocks the script file

[Jos]

No error messages from aut2exe. Trend Micro as well wasn't configured to log those actions (by default?).
I'm an ordinary user in this respect and was glad that our AV guys had a look and finaly a solution for this problem.
So this is a documentation for future users facing the same problem
 

The problem i guess is that aut2exe completes successfully after which the AV programs rips it out again, because else think the AUT2EXE will show an error in case it is unable to add it to the PE header.

Jos

[water]

The problem i guess is that aut2exe completes successfully after which the AV programs rips it out again, because else think the AUT2EXE will show an error in case it is unable to add it to the PE header.

Jos

That's how I see it as well.
Do you think it would be useful to collect such strange behavior by security tools and the solution in a separate thread or wiki article?

[Jos]

That's how I see it as well.Do you think it would be useful to collect such strange behavior by security tools and the solution in a separate thread or wiki article?

We might want to add it to the original post in the pinned topic we have on are-my-autoit-exes-really-infected.

Jos

[water]

Added a post to the "are-my-autoit-exes-really-infected" thread explaining the problem and pointing to this thread for the details.

[Dana]

On 1/13/2016 at 10:20 AM, water said:

Problem solved!
Behavior Monitoring has to be disabled for Aut2Exe.exe.

Thank you!  Our local building IT guy (as opposed to the corporate guy who is much less cooperative) was able to do it, and it appears to have fixed the problem.

[TheDcoder]

Good to hear that this case is closed after 9 months and 20 days!

[water]

Same here. Our local AV admin played with the system until he found the problem 😊

[Dana]

I don't know if the IT guy changed it back for some reason, he isn't here today, but I'm again unable to compile scripts, same thing.  But I found a workaround:  I had observed that if I tried over and over, once in several dozen attempts it would compile successfully, which is was easy to see as the resultant exe was larger.  I started writing a script to compile it using the command line, check the file size, and continue looping until the script was larger than 1MB (the file size was around 800K when it fails).  However, even before I put the loop code in I discovered that it worked every time when done from my preliminary script:

$scriptfile = FileOpenDialog("Select file to compile", @ScriptDir & "\", "Script files (*.au3)")
ShellExecuteWait("C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe", '/in "' & $scriptfile & '"', @scriptdir & "\")

 

[Dana]

Correction, it doesn't work every time, I guess I was just lucky yesterday.  But the loop works:

$scriptfile = FileOpenDialog("Select file to compile", @ScriptDir & "\", "Script files (*.au3)")
Do
    ShellExecuteWait("C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe", '/in "' & $scriptfile & '"', @ScriptDir & "\")
    $exefile = StringTrimRight($scriptfile, 3) & "exe"
    ConsoleWrite("file size of " & $exefile & " is " & FileGetSize($exefile) & @CRLF)
Until FileGetSize($exefile) > 1000000

which gives me:

>"C:\Program Files (x86)\AutoIt3\SciTE\..\AutoIt3.exe" "C:\Program Files (x86)\AutoIt3\SciTE\AutoIt3Wrapper\AutoIt3Wrapper.au3" /run /prod /ErrorStdOut /in "P:\Alicat\compilefile.au3" /UserParams    
+>10:19:05 Starting AutoIt3Wrapper v.15.729.1555.1 SciTE v.3.5.4.0   Keyboard:00000409  OS:WIN_7/Service Pack 1  CPU:X64 OS:X64    Environment(Language:0409)
+>         SciTEDir => C:\Program Files (x86)\AutoIt3\SciTE   UserDir => C:\Users\me\AppData\Local\AutoIt v3\SciTE\AutoIt3Wrapper   SCITE_USERHOME => C:\Users\me\AppData\Local\AutoIt v3\SciTE 
>Running AU3Check (3.3.14.1)  from:C:\Program Files (x86)\AutoIt3  input:P:\Alicat\compilefile.au3
+>10:19:05 AU3Check ended.rc:0
>Running:(3.3.14.1):C:\Program Files (x86)\AutoIt3\autoit3.exe "P:\Alicat\compilefile.au3"    
--> Press Ctrl+Alt+Break to Restart or Ctrl+Break to Stop
file size of P:\Alicat\A58 160209-1.exe is 855040
file size of P:\Alicat\A58 160209-1.exe is 855040
file size of P:\Alicat\A58 160209-1.exe is 855040
file size of P:\Alicat\A58 160209-1.exe is 1277440
+>10:19:25 AutoIt3.exe ended.rc:0
+>10:19:25 AutoIt3Wrapper Finished.
>Exit code: 0    Time: 20.57

So this time it took four tries.  Still better than almost never working from SciTE.

Others might need a different size limit... my script in this case is over 1000 lines with multiple includes.