AutoIt Error - Unable to open the script file.

[mdwerne]

Good morning from New Mexico,

I have a script that I call and run remotely on a number of machines (XP Pro, Vista, Win 7 32/64).

Most of the time the script runs fine and does its job, on other occasions it crashes out with the follow error:

****************************************
* AutoIt Error                         *
*                                      *
*                                      *
*  X Unable to open the script file.   *
*                                      *
*                                      *
****************************************

I've looked at my script and these machines and for the life of me, I can't figure out what is causing the crash

or how to code around it. If anyone has a few minutes to assist, can you please take a look at my code and make any

suggestions you have for making it more robust (no error popups for the user ever)?

Customers are all admins on their boxes, UAC is enabled on the Vista and Win7 machines and they all have permissions to write to the network share.

Thanks for any assistance, Mike

expandcollapse popup

#NoTrayIcon
#region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_icon=HWID Reset.ico
#AutoIt3Wrapper_outfile=Symantec HWID Reset.exe
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_UseX64=n
#AutoIt3Wrapper_Res_Comment=Symantec HWID Reset
#AutoIt3Wrapper_Res_Description=Symantec HWID Reset
#AutoIt3Wrapper_Res_Fileversion=2.6.0.0
#AutoIt3Wrapper_Res_Language=1033
#AutoIt3Wrapper_Res_requestedExecutionLevel=requireAdministrator
://////=__=...
#AutoIt3Wrapper_AU3Check_Stop_OnWarning=y
#AutoIt3Wrapper_Run_Tidy=y
#Tidy_Parameters=/kv 1
#endregion ;**** Directives created by AutoIt3Wrapper_GUI ****

#include <Services.au3>
#include <File.au3>

Opt('MustDeclareVars', 1)

Global $SEP11_Home, $SEP11_Ver, $SEP_HWID_FILE, $LogFile, $Key
Global $ProductVersion = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC", "ProductVersion")

If @OSArch = "X86" Then
    $SEP11_Home = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV", "Home Directory")
    $SEP11_Ver = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC", "ProductVersion")
    $SEP_HWID_FILE = @HomeDrive & "\Program Files\Common Files\Symantec Shared\HWID\sephwid.xml"
    $LogFile = @HomeDrive & "\Program Files\Common Files\Symantec Shared\HWID\HWID.log"
    $Key = "HKLM"
ElseIf @OSArch = "X64" Then
    $SEP11_Home = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV", "Home Directory")
    $SEP11_Ver = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC", "ProductVersion")
    $SEP_HWID_FILE = @HomeDrive & "\Program Files (x86)\Common Files\Symantec Shared\HWID\sephwid.xml"
    $LogFile = @HomeDrive & "\Program Files (x86)\Common Files\Symantec Shared\HWID\HWID.log"
    $Key = "HKLM64"
ElseIf @error Then
    Exit
Else
    Exit
EndIf

; ===============================================================================================================================
; Command Line Interpretation
; ===============================================================================================================================
If $CmdLine[0] = 0 Then
    If FileExists($LogFile) And $SEP11_Ver > "11.0.5" Then
        MsgBox(0, "Already Run", "The HardwareID Reset has already been run on this machine.")
        _FileWriteLog($LogFile, @ComputerName & " - " & @UserName & " - " & $SEP11_Ver)
        Exit
    Else
        ResetIt()
    EndIf
ElseIf $CmdLine[1] == "/s" Then
    If FileExists($LogFile) And $SEP11_Ver > "11.0.5" Then
        ;MsgBox(0, "Already Run", "The HardwareID Reset has already been run on this machine.")
        _FileWriteLog($LogFile, @ComputerName & " - " & @UserName & " - " & $SEP11_Ver)
        Exit
    Else
        ResetItSilent()
    EndIf
EndIf

; ===============================================================================================================================
; Functions
; ===============================================================================================================================
Func ResetIt()

    Local $i

    If WinExists("Symantec Endpoint Protection") Then
        WinClose("[CLASS:SymCorpUIMainWindowClass]", "")
    EndIf

    ; Check to see if SmcService even exists
    If _Service_Exists("SmcService") Then

        ; Stop SmcService Service
        Run($SEP11_Home & "smc.exe -stop", "", @SW_HIDE)

        ;give service 30 seconds to stop
        $i = 0
        While _Service_Running("SmcService") > 0 And $i < 30
            Sleep(1000)
            $i = $i + 1
        WEnd

        ; See if service is still running, if it is, give error and exit
        If _Service_Running("SmcService") Then
            MsgBox(16, "Error", "Failed to stop SmcService service, exiting.")
            Exit
        Else
            If $ProductVersion > "11.0.5000.000" Then
                ; if sephwid.xml is found, delete it
                FileDelete($SEP_HWID_FILE)
                RegWrite($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "HardwareID", "REG_SZ", "")
                RegWrite($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "PreferredGroup", "REG_SZ", "My Company\Default Group")
            Else
                RegWrite($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "PreferredGroup", "REG_SZ", "My Company\Default Group")
            EndIf

            ; Start SmcService Service
            Run($SEP11_Home & "smc.exe -start", "", @SW_HIDE)

            ;give service 10 seconds to start
            $i = 0
            While _Service_Running("SmcService") < 1 And $i < 10
                Sleep(1000)
                $i = $i + 1
            WEnd

            If _Service_Running("SmcService") < 1 Then

                ; Try To Start SmcService Service Again
                Run($SEP11_Home & "smc.exe -start", "", @SW_HIDE)

                ;give service 10 more seconds to start
                $i = 0
                While _Service_Running("SmcService") < 1 And $i < 15
                    Sleep(1000)
                    $i = $i + 1
                WEnd
            Else
            EndIf

            If $i == 15 Then
                MsgBox(16, "Error", "After two attempts, the SMC Service could not be started. Please contact mike for assistance.")
                Exit
            Else
                ;just continue
            EndIf
        EndIf

        If _Service_Running("SmcService") Then
            Local $NewKey = RegRead($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "ComputerID")
            _FileWriteLog("\\SEPQ-Console\ESP\HWID Reset.log", @UserName & " on " & @ComputerName & " - " & $NewKey & " - " & $SEP11_Ver)
            _FileWriteLog($LogFile, @ComputerName & " - " & @UserName & " - " & $SEP11_Ver)
            MsgBox(64, "Success", "Successfully reset the SEP HWID!", 10)
            Sleep(5000)
            Run($SEP11_Home & "smc.exe -updateconfig", "", @SW_HIDE)
        Else
            MsgBox(16, "Error", "Attempts to reset the SEP HWID have failed. Please contact Mike for assistance.")
        EndIf
        Exit

    Else
        MsgBox(32, "Error", "Symantec Endpoint Protection 11 does not appear to be installed.")
    EndIf
    Exit
EndFunc   ;==>ResetIt

Func ResetItSilent()
    Local $i

    If WinExists("Symantec Endpoint Protection") Then
        WinClose("[CLASS:SymCorpUIMainWindowClass]", "")
    EndIf

    ; Check to see if SmcService even exists
    If _Service_Exists("SmcService") Then

        ; Stop SmcService Service
        Run($SEP11_Home & "smc.exe -stop", "", @SW_HIDE)

        ;give service 30 seconds to stop
        $i = 0
        While _Service_Running("SmcService") > 0 And $i < 30
            Sleep(1000)
            $i = $i + 1
        WEnd

        ; See if service is still running, if it is, give error and exit
        If _Service_Running("SmcService") Then
            Exit
        Else
            If $ProductVersion > "11.0.5000.000" Then
                ; if sephwid.xml is found, delete it
                FileDelete($SEP_HWID_FILE)
                RegWrite($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "HardwareID", "REG_SZ", "")
                RegWrite($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "PreferredGroup", "REG_SZ", "My Company\Default Group")
            Else
                RegWrite($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "PreferredGroup", "REG_SZ", "My Company\Default Group")
            EndIf

            ; Start SmcService Service
            Run($SEP11_Home & "smc.exe -start", "", @SW_HIDE)

            ;give service 10 seconds to start
            $i = 0
            While _Service_Running("SmcService") < 1 And $i < 10
                Sleep(1000)
                $i = $i + 1
            WEnd

            If _Service_Running("SmcService") < 1 Then

                ; Try To Start SmcService Service Again
                Run($SEP11_Home & "smc.exe -start", "", @SW_HIDE)

                ;give service 10 more seconds to start
                $i = 0
                While _Service_Running("SmcService") < 1 And $i < 15
                    Sleep(1000)
                    $i = $i + 1
                WEnd
            Else
            EndIf

            If $i == 15 Then
                Exit
            Else
                ;just continue
            EndIf
        EndIf

        If _Service_Running("SmcService") Then
            Local $NewKey = RegRead($Key & "\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink", "ComputerID")
            _FileWriteLog("\\SEPQ-Console\ESP\HWID Reset.log", @UserName & " on " & @ComputerName & " - " & $NewKey & " - " & $SEP11_Ver & " : Silent")
            _FileWriteLog($LogFile, @ComputerName & " - " & @UserName & " - " & $SEP11_Ver & " : Silent")
            Sleep(5000)
            Run($SEP11_Home & "smc.exe -updateconfig", "", @SW_HIDE)
        Else
            ;MsgBox(16, "Error", "Attempts to reset the SEP HWID have failed. Please contact Mike for assistance.")
        EndIf
        Exit

    Else
        ;MsgBox(32, "Error", "Symantec Endpoint Protection 11 does not appear to be installed.")
    EndIf
    Exit
EndFunc   ;==>ResetItSilent

Exit

Edited May 27, 2010 by mdwerne

[jchd]

How do you run this script? Do the client run the executable version or do they run the source script associated with AutoIt3.exe?

Also which version do you run?

[mdwerne]

How do you run this script? Do the client run the executable version or do they run the source script associated with AutoIt3.exe?

Also which version do you run?

The script is called by a separate process that downloads the compiled executable to the local %homedrive% directory and executes it using the /s (silent) switch. Originally I was using the %temp% directory for the download and execute, but I was getting the same error.

Running AutoIt - 3.3.6.1

Thanks for looking/asking...

-Mike

[jchd]

Can you post a link to the Services.au3 UDF you're using or post it here?

Sorry if I'm asking dumb questions or requests but I don't get it right now. It needs a reason for behaving this way.

[mdwerne]

Can you post a link to the Services.au3 UDF you're using or post it here?

Sorry if I'm asking dumb questions or requests but I don't get it right now. It needs a reason for behaving this way.

Here is the Services UDF I'm using.

You're helping me work out an issue that I can't resolve on my own, there is very little I would consider a dumb question or request.

Thanks again,

-Mike

Services.au3

[Jos]

Could it be that the AV on the customers PC is causing this error?

Seems that the code portion that is looking for the embedded script code is failing to find/read it in the exe.

This is all happening before the actual script is performed.

Jos

Edited May 28, 2010 by Jos

[jchd]

Here's the cavalry to the rescue!

My fault, I just can't wrap my head around the idea that AutoIt can be classified as malware. That would explain the behavior.

[mdwerne]

Could it be that the AV on the customers PC is causing this error?

Seems that the code portion that is looking for the embedded script code is failing to find/read it in the exe.

This is all happening before the actual script is performed.

Jos

Yes, I had thought about the AV being a part in the play but so I had taken a couple steps.

1) This utility actually actually fixes an issue we have with our AV program and directly interfaces with the AV program itself.

2) Because of that, I put an exception into our AV system (I'm the admin) that ignore the program altogether, maybe the exception is not entirely working.

If the AV system were truly the cause, I would expect the issue to happen on every machine...the problem only crops up in about 1 in 20 machines.

I will continue testing under the guise that it still could be the AV system and see if I can isolate it further.

Thanks for the input!

-Mike

[mdwerne]

Here's the cavalry to the rescue!

My fault, I just can't wrap my head around the idea that AutoIt can be classified as malware. That would explain the behavior.

Thanks again for taking the time to look at this jchd, I will push on assuming that my script is not the issue.

Have a great weekend!

-Mike

[Jos]

Yes, I had thought about the AV being a part in the play but so I had taken a couple steps.

1) This utility actually actually fixes an issue we have with our AV program and directly interfaces with the AV program itself.

2) Because of that, I put an exception into our AV system (I'm the admin) that ignore the program altogether, maybe the exception is not entirely working.

If the AV system were truly the cause, I would expect the issue to happen on every machine...the problem only crops up in about 1 in 20 machines.

I will continue testing under the guise that it still could be the AV system and see if I can isolate it further.

Thanks for the input!

-Mike

Iam also not sure why this is happening, but what happens when you shell your script is that it will search, read and decrypt the script code stored in the EXE. It looks like the "read scriptcode" portion is failing and triggering this error, so that is why I was thinking of AV.

Could it be the tampering setting in SAV/SEP that is causing this?

Jos

[mdwerne]

Iam also not sure why this is happening, but what happens when you shell your script is that it will search, read and decrypt the script code stored in the EXE. It looks like the "read scriptcode" portion is failing and triggering this error, so that is why I was thinking of AV.

Could it be the tampering setting in SAV/SEP that is causing this?

Jos

I have an global exception for that program in the Tamper Protection settings of SEP. Weird, just weird. Thanks for the suggestion though.

[Fire]

Hi

mdwerne

i saw this in your script:

#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_UseX64=n

Do you then manually pack it with packer/protectors?

I think this error related with incorrect OEP and Import table RVA in your executable.

And you can get this error

Try to put only read attribute to your executable and then execute it.

Edited June 1, 2010 by Fire

[mdwerne]

Hi

mdwerne

i saw this in your script:

#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_UseX64=n

Do you then manually pack it with packer/protectors?

I think this error related with incorrect OEP and Import table RVA in your executable.

And you can get this error

Try to put only read attribute to your executable and then execute it.

Hi Fire,

No, the app is not packed/protected at all. I have UPX off because I've read that some AV Programs see packed executables as a threat just for that reason alone. UseX64 is set to n because I just started with a new Win7 64bit machine and I thought maybe there might be some compatibility issues with an app compiled on/with a 64bit machine/compiler and executed primarily on 32bit machines. I'm shaky in this area though...

You lost me on the acronyms (OEP and RVA?) Can you clarify what you mean?

I will set the app to read only and see what happens...I am running another test on Friday.

Thanks for the input,

-Mike

[SmOke_N]

I see where you put what operating systems they are installed on, but what operating systems do they fail on?

Is it always the same machines/users?

[mdwerne]

I see where you put what operating systems they are installed on, but what operating systems do they fail on?

Is it always the same machines/users?

So far, the failures (10 out of 100) have all been Windows 7 machines. Of those, I believe most have been 64bit. UAC is enabled too. Edited June 2, 2010 by mdwerne

[SmOke_N]

Your code is a bit confusing.

If @OSArch = "X86" Then
    $SEP11_Home = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV", "Home Directory")
    $SEP11_Ver = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC", "ProductVersion")
    $SEP_HWID_FILE = @HomeDrive & "\Program Files\Common Files\Symantec Shared\HWID\sephwid.xml"
    $LogFile = @HomeDrive & "\Program Files\Common Files\Symantec Shared\HWID\HWID.log"
    $Key = "HKLM"
ElseIf @OSArch = "X64" Then
    $SEP11_Home = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV", "Home Directory")
    $SEP11_Ver = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC", "ProductVersion")
    $SEP_HWID_FILE = @HomeDrive & "\Program Files (x86)\Common Files\Symantec Shared\HWID\sephwid.xml"
    $LogFile = @HomeDrive & "\Program Files (x86)\Common Files\Symantec Shared\HWID\HWID.log"
    $Key = "HKLM64"
ElseIf @error Then
    Exit
Else
    Exit
EndIf

1. ElseIf @OSArch = "X64" Then - You seem to insist that your data is installed in x86 architecture even though you set $key to read and write further to x64 arch ... If everything that you do and symantec does is x86 then you don't need to make $key HKLM64

2. ElseIf @error Then - What exactly are you expecting to throw an error exception? ( You call nothing before this condition statement ).

----

If I had to guess, I'd say that Services.au3 was your main issue though.

It assumes that you have access/permission to access things that UAC probably blocks, as well as a few dllcalls ( which dllcalls have been known to cause issues from x86 to x64 formats. ).

Do you not have a Win7 x64 test machine? I'd at least get a VM of one before I deployed my work on an unknown system.

Wish I could help more, but I don't feel like creating a simple recreator that doesn't do all the regread/write stuff.

Edit:

If I remember correctly, I tried to use a similar method in another language to start a service on my Win7 X64 as _Service_Create() uses and it failed ( don't think I got the can't open script error though ). Don't know think I ever bothered to find out why.

Edited June 2, 2010 by SmOke_N

[mdwerne]

Your code is a bit confusing.

If @OSArch = "X86" Then
    $SEP11_Home = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV", "Home Directory")
    $SEP11_Ver = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC", "ProductVersion")
    $SEP_HWID_FILE = @HomeDrive & "\Program Files\Common Files\Symantec Shared\HWID\sephwid.xml"
    $LogFile = @HomeDrive & "\Program Files\Common Files\Symantec Shared\HWID\HWID.log"
    $Key = "HKLM"
ElseIf @OSArch = "X64" Then
    $SEP11_Home = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV", "Home Directory")
    $SEP11_Ver = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SMC", "ProductVersion")
    $SEP_HWID_FILE = @HomeDrive & "\Program Files (x86)\Common Files\Symantec Shared\HWID\sephwid.xml"
    $LogFile = @HomeDrive & "\Program Files (x86)\Common Files\Symantec Shared\HWID\HWID.log"
    $Key = "HKLM64"
ElseIf @error Then
    Exit
Else
    Exit
EndIf

1. ElseIf @OSArch = "X64" Then - You seem to insist that your data is installed in x86 architecture even though you set $key to read and write further to x64 arch ... If everything that you do and symantec does is x86 then you don't need to make $key HKLM64

2. ElseIf @error Then - What exactly are you expecting to throw an error exception? ( You call nothing before this condition statement ).

----

If I had to guess, I'd say that Services.au3 was your main issue though.

It assumes that you have access/permission to access things that UAC probably blocks, as well as a few dllcalls ( which dllcalls have been known to cause issues from x86 to x64 formats. ).

Do you not have a Win7 x64 test machine? I'd at least get a VM of one before I deployed my work on an unknown system.

Wish I could help more, but I don't feel like creating a simple recreator that doesn't do all the regread/write stuff.

Edit:

If I remember correctly, I tried to use a similar method in another language to start a service on my Win7 X64 as _Service_Create() uses and it failed ( don't think I got the can't open script error though ). Don't know think I ever bothered to find out why.

SmOke_N,

Thanks for the look...you and all the others have got me thinking about this issue in different ways, I really appreciate the time and you've all helped more than enough.

Regarding your notes:

1) In our environment we have all flavors of Enterprise Windows OSes...2k, XP, Vista and 7. Not to mention all the various server OSes. We install SEP on all flavors and both 32 and 64 bit machines. SEP has different installers for 32 and 64 bit systems, so I have to code for the different path locations.

2) After looking again, I see that ElseIf @error Then is doing nothing for me. I think originally I was trying to have a catch all for anything that was not X86 or X64. I guess I could have just written ElseIf @OSArch = "IA64" Then exit

On your comments:

I understand what you mean regarding the Services.au3...but I need to be able to stop/start/check services to accomplish my task...even on the Vista/7 machines that have UAC enabled. I will poke around and see what other options may be available to code around the error. Maybe trying to write some temp files or use IsAdmin to test my permissions before running the bulk of the script. Currently the script is called/run under the LocalSystem Account. I wonder if that is contributing?

My development machine is running Win7 64 bit, sadly my machine does not exhibit the error. All I can guess is that the culprit machines have something "extra" set, or on them, that is contributing to the error. I do have access to and test my scripts on all our different OSes before deploying...but the error is very random and did not come up in initial testing.

Again, you have all helped plenty. Time for me to start doing some more testing and isolating of the issue on my own.

-Mike

Edited June 3, 2010 by mdwerne

[DCocker]

Hi Mdwerne

Did you ever find a resolution for this problem? We seem to have a very similar error with a script. It fails in roughly the same ratio as you (about 1 in 10) but only on Windows 7 64Bit so far, with the same error message as you.

Was it the Services.au3 in the end?

Any Help greatly appreciated

Thanks

Dan.

[DCocker]

Hi Mdwerne

Did you ever find a resolution for this problem? We seem to have a very similar error with a script. It fails in roughly the same ratio as you (about 1 in 10) but only on Windows 7 64Bit so far, with the same error message as you.

Was it the Services.au3 in the end?

Any Help greatly appreciated

Thanks

Dan.

OK - Problem Solved, my mistake.

For info, if anyone has a similar problem. We were calling a compiled script (from a login script) that ran from the local users System32 directory. When we moved the location of the script to a more sensible place it ran no problem.

Thanks

[somo]

Symantec Endpoint Protection sees AutoIt Scripts as a commercial keylogger in 'Sonar'.