Microsoft-Windows CAPI2 failed extract of third-party root list from auto update cab

Martin:

I ran sfc and it executed with no errors ("Windows Resource Protection did not find any integrity violations").

Then I used msconfig.exe to disable all non-Microsoft services, as you directed, and did a restart -- no improvement -- the system behaved the same, pausing on an empty blue screen.

Here's more info that might be helpful:  During boot, the usual things happen up to the display of the Welcome message.   During the display of the Welcome message, the disk rattles as usual but then slows down to just a few flickers.  After a few sectonds of this, the screen changes to empty blue.  After a few more seconds, the disk starts rattling at 'normal' intensity and the blue screen clears (though on one occasion, as I described above, it stayed on the blue screen).

Maybe during the pause in disk activity during the Welcome display the system is tring to access the internet?  And getting the root cert problem?   While waiting maybe the Welcome times out and blue screen comes?  Then the internet reply causes the resumption of the usual boot sequence?  (and if no reply, no resumption?)

Anyway, it looks like a Microsoft problem, since the problem seems to occur even with just MS services enabled on a 'clean' boot.  Has anyone checked that the certificate it wants is still valid?  That looks like the obvious thing to check.

Looking forward to your reply, and thanks for your help.

Addendum:  When I went to resture the normal boot (using msconfig.exe) I found TrueVector was enabled, which is ZoneAlarm's firewall, in case that's useful info.  Also, my hardware is a Dell Inspiron 531 in an off-the-shelf config.

Hi again Martin, I just found the following on another Forum:

"Event Log Online Help offers absolutely no help other than to identify the problematic cab download as the "Automatic Root Certificates Update component designed to automatically check the list of trusted authorities on the Microsoft Windows Update Web site."

My system clock is correctly synched to Microsoft time and as owner/administrator I have full permissions to extract the file. But the properties for authroot.stl indicate "The certificate is not valid for the requested usage." It was signed by Microsoft on December 19, 2007.

Bottom line, this Microsoft-created Certificate Trust List is out of date or faulty, yet Microsoft refuses to issue a current certificate and has yet to reply to dozens of online posts seeking answers, yet another known Vista issue Microsoft ignores. Can Microsoft please explain why? Moreover, will Microsoft please update its Trust List for its own Windows Update site? "

This covers my error, so what should I do now.  Confuseduser

Hi Martin, I just ran scannow.  The verification phase was 100 percent complete and stated "Windows Resource Protection did not find any integrity violations".  After that scannow stopped. I have no problems with the Startup (like the other user above), therefore, I am wondering whether I need to follow your suggestions.  However, I now realize that my message turns up after 4 pm (and at 4 pm every day I run the Windows Automatic Update).  The error message led me to Microsoft TechNet, Event ID 11 Automatic Root Certificates Update Configuration. Under Resolve, I was asked to ensure that the user account is logged on with full Control permission.  I checked and it is logged on as System.  However, I cannot follow "Verify" because I do not know how to find a Web browser that requires the Automatic Root Certificates.  All of the above is definitely caused by the last Vista Service Pack 2 and I assume that my computer is trying every day to find whatever is wrong.  Confuseduser