Event ID 4107

[Pez]

Hi all.

My system did a "freeze", and after re-booting, I checked the Event Viewer/ Applications.

I don't know whether or not that this was the one to cause the "freeze", but I have many, MANY, instances of this going back for days:

Event ID 4107 Source CAP12

Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

I did some Googling on this Event and came across many articles and posts on other tech forums.....but nothing really clear on WHAT to do about it. I tried one suggestion on downloading the root list manually, but I don't know where to put it.

I tried another suggestion of:

Command Prompt: sfc/scannow

After the scan, a message did say that corrupt files were found, but were unable to fix them. It said check in CBS.log - which I did - but I can't open the file in Notepad.

Anybody familiar with this Event 4107?

Thanks for any help or suggestions.
Pez

 

[zigzag3143]

Hi all.

My system did a "freeze", and after re-booting, I checked the Event Viewer/ Applications.

I don't know whether or not that this was the one to cause the "freeze", but I have many, MANY, instances of this going back for days:

Event ID 4107 Source CAP12

Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

I did some Googling on this Event and came across many articles and posts on other tech forums.....but nothing really clear on WHAT to do about it. I tried one suggestion on downloading the root list manually, but I don't know where to put it.

I tried another suggestion of:

Command Prompt: sfc/scannow

After the scan, a message did say that corrupt files were found, but were unable to fix them. It said check in CBS.log - which I did - but I can't open the file in Notepad.

Anybody familiar with this Event 4107?

Thanks for any help or suggestions.
Pez

Yep event id 4017 source cap 12 is basically a timed event. It is saying that the 3rd party root it is trying to extracts certificate has expired and it cant therefor be extracted.

Have you checked the system clock to make sure it is accurate?

Since SFC cant fix the system files, you may have to either restore from a backup before the problem started, or do a repair install. DO you have a win 7 dvd (not a restore dvd)?

Ken

 

[Bill2]

Hello,

If the event bothers you, just download the third party root list from the website shown in the error.

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

When prompted for the download location, save it anywhere you wish, say the desktop. It'll be in zipped format, so unzip it using winrar or 7z or whatever unzipper you use, again to the desktop. Open the extracted folder, inside will be a file called "authroot".

Right click on authroot and click on "Install CTL". Then just follow the wizard.

 

[Pez]

Zigzag & Bill2: thanks for your replies and sorry for the delay in getting back.

Zigzag: By "system clock", do you mean checking the clock (or "time") while in the BIOS? If so, then yes, the time/ date are accurate. If this is not what you mean, then could you tell me what it is?

And when you say do a "restore from backup", you actually mean doing a "System Restore"(System Properties/ System Protection/ System Restore)? And yes, I do have a Win 7 DVD.

Bill2: I tried what you suggested. At first, I wasn't aware that one could do that. I had the file "authroot" unzipped, but when I would left-click on it, it wouldn't install anything. But I didn't realize I could right-click on it So, I did, and then Install CTL. But after a system re-boot, I checked the Event Viewer/ Applications, and still, many, MANY instances of this Event ID 4107.

Is a System Restore my best option at this point?

Please let me know what you think.

Thanks,
Pez

 

[Judesman]

Pez, did you ever resolve this one. I have had exactly the same problem - CAP 12 Error, may be 10 a day or more. It has been like this for months now. I downloaded authroot but it didn't make any difference.

Judesman

 

[Pez]

Judesman:

No, I never resolved this problem. I followed the advice from the above two posters (zigzag & Bill), although, I don't want to go to the extreme of doing a repair install.

And.....I can't remember what part of a Microsoft web site I was at, but I contacted Microsoft technical support through e-mail, and we had many e-mail exchanges back-and-forth. The tech support technician was very pleasant in our exchanges, but he freely admitted that there was nothing at this point in time to "fix" my situation; no solution.

You say you get 10 a day or more? I've got that beat!! Actually, I have so many instances of this 4107 CAP 12 error that it's difficult to count them all in my Event Viewer. I scroll & scroll my way through it, and each and every day there are SO many instances of it that I gave up on counting them; too many to count!!

I did a Bing search on it (Event ID 4107), and one of the results is a link right to this message board!! Check out the search results link: Event ID 4107 - Bing

Count down the results list to the sixth one and it leads right here to this thread. I checked the other results from the search, and nothing really definitive is explained. Some say it's "no big deal" and nothing to worry about. One of the result links (over at tomshardware.com) says that the problem will "clear itself" in time.

"In time"?? I've been getting this error message since early July and it's now at the end of August. How much time is needed for this kind of problem to "clear itself"?

On a good note: I haven't had any more system freezes like I mentioned at the beginning of my post. Maybe the 4107 CAP 12 error didn't cause the system freeze, but I'd still like this error to be gone.

If you have any luck with a fix, let me know!!!
Pez

 

[Judesman]

Thanks Pez, that is appreciated. I found several forum threads on this one by searching CAP 12 Error. There are all sorts of suggestions out there and few seem to work. I think we just have to live with it but it is annoying although it does not seem to have any effect on my computer. I will come back to you if I make any progress.

Judesman.

 

[mjf]

Search this forum for "CAPI2 4107". Google it (as you have done) and you will find the problem is widespread and hit many people around 11 July 2010.
The feeling is that the root of the problem is an MS update and ultimately a problem for MS to rectify.
I get the warning when some third party software updates. Noticed it occasionally with Adobe but very regularly with McAfee probably because it updates regularly.
I only notice the error when I look at windows app logs in evet viewer. None of the application software is objecting and I notice no performance change in anything.
Not totally acceptable but until it causes performance issues I am ignoring it.

Your sfc/scannow problem may be unrelated.

 

[Phone Man]

To stop the Event View errors from showing up here is an alternate.
Open Event Viewer and go to Applications and Service Logs/Microsoft/Windows/CAPI2/Operational and on the right side Enable Log. This will now show the errors in this log with more detail as to what programs are causing the error. The good thing is the errors will no longer appear in Summary and makes for a cleaner view.

From what I have read these errors started when the authrootstl was updated back in June and there are errors in that file. I believe that file is only updated about every 3 months by Microsoft so maybe the next version will clear the problem.

Jim

 

[Judesman]

Thanks mjf, I have really come to the same conclusion.

Phone Man, that is interesting because I found a link to a thread that explained "Enable Log" in CAP 12. (Thanks to Pez for that one) What I didn't realise was that this stopped warnings and errors appearing in Administrative Events in Custom View. Initially I thought that the problem had been solved. I have changed CAP 12 back to "Disable Log" re- started the computer and I have the CAP 12 error back again. I see that all the other logs under Microsoft are enabled so would that have happened when I altered CAP 12 to enable? It seems unlikely as they are all enabled except for CAP12 which I changed back to disable. Perhaps by default CAP 12 is the only log that is disabled. I shouldn't be playing around with this really as I am not much of a techie.

Thanks for the input.

Judesman.

 

[Phone Man]

All that my suggestion does is stop the CAPI2 errors from showing in the summary log so that log is a lot cleaner. The CAPI2 Operational log will also give more detail on what is actually going on and if you want you can research each error but is probably a waste of time. Hopefully the next version of authrootstl will clear the errors.

Jim

 

[Judesman]

Thanks Phone Man, I assume that when you refer to the summary log you are talking about Administrative Events under Custom Views?

Judesman.

 

[Phone Man]

I normally use the Summary of Administrative Events since it breaks it down by type, but it will also stop them in the view you mentioned. Since I know it won't be fixed for a while and not really causing any problems I like to keep the Errors to a minimum and from time to time I can look at the CAPI2 log and see how it is doing.
Give it a try and see if you like it better. You can always go back.

Jim

 

[Judesman]

Thanks Phone Man. I see now that the summary is under Event Viewer (Local). I had been looking at Custom Views. I will try enabling the log in CAP 12 again. Thanks for your help.

Judesman.

 

[Packet]

i found the fix for this.
Event ID 4107 or Event ID 11 is logged in the Application log in Windows Vista, in Windows Server 2008, and in later versions of Windows and of Windows Server
i didnt do the certutil -urlcache * delete because i figured the expired cert was in a local system profile somewhere.
step 2 and all the deletions worked.
test reboot and everything up and running

 

[Judesman]

Thank you Packet for posting. You say that you didn't do the "certutil -urlcache*delete. But step 2 and the deletions worked". In the link under Resolution step 2 is "certutil -urlcache*delete" So I am not quite sure what it is that you have done to resolve this problem. Could you clarify please.

Judesman.

 

[mjf]

Windows Updates & Activation » CAPI2

Have a look at this thread. It has solved the problem for a number of us.
There should be a space before and after the *.

 

[Judesman]

Thank you MJF. I will have a look at this. The trouble is I am not much of a techie and as usual I think Microsoft has let us down on this one assuming that everyone who owns a computer is a technical genius. Also thanks for pointing out the spaces and *. Also I think there is a space after certutil before the -.

Thanks for your reply.

 

[Packet]

sorry - i've been away tending to some personal stuff....
i meant i didnt do the certutil delete stuff but all the rest of the other steps which involve manually deleting files

 

[Judesman]

Thanks Packet for clarifying that. When I get some time I am going to have a go at this but I am not very technical and I want to try this when I have plenty of time. Thanks for posting.

Judesman.