Resources

Recently I have noticed a thing called “Bootstrapper” noted in my Zone Alarm warnings. Is this anything to be concerned about?

What is Bootstrapper?

Bootstrapper is a legitimate computer mechanism that is typically used in conjunction with installation files. Bootstrapping involves an executable file that updates the installation package or installs additional files before the actual installation begins. Bootstrapper errors can occur if the installer is missing files or if the .NET Framework is damaged on your computer.

Repairing the .NET Framework

The .NET Framework is a software framework that is installed as part of the Microsoft operating system. Many computer programs are written specifically for this framework. When the .NET Framework is damaged, applications requiring it may generate errors. If you think that this may be the case, you can repair the .NET Framework on your computer easily enough.

Go to the Control Panel and select Add and Remove Programs (or Programs and Features in Windows Vista) and find the highest version of Microsoft .NET Framework. Click the Change/Remove button and choose the Repair option which will restore the .NET Framework to its original state.

Zone Alarm’s Bootstrapper Error

Since Zone Alarm is a computer security product, the fact that it is warning you about Bootstrapper does sound alarming. What is the exact error message? If it seems to be related to the installation of Zone Alarm or that Bootstrapper can’t find necessary files to complete an installation, then it’s likely a legitimate issue with Bootstrapper or the .NET Framework and not some rogue virus posing as a legitimate Windows file. For example, if a Zone Alarm update failed and generated the Bootstrapper error, this could indicate a problem with the update file. Downloading a new copy of the update file might solve the issue. Without knowing the exact error message, it’s tough to be certain.  

Bootstrapper Malware

On the other hand, it’s not out of the ordinary for malware makers to name their malicious programs after legitimate operating system files, services, or processes. After all, if a user believes the file is legitimate, he’ll leave it alone. Update Zone Alarm with the latest updates and then run a FULL system scan to see if anything unusual is detected. If Zone Alarm quarantines a suspicious file named Bootstrapper, chances are it was malware. As long as it’s quarantined, your computer will be fine.

Of course, this is all fairly speculative. Let us know the exact error message and we’ll be better able to help you solve this mysterious Bootstrapper error.

My machine is running XP Home SP3, it’s not that old, and I have it configured with Zone Alarm and an extra antivirus package (Paretologic - which I found out about through your website). Fairly recently Zone alarm alerts began appearing for svchost.exe (wanting to act as a server etc.). Mostly I have denied the request without any apparent ill effect, browsers work OK etc. No virus or trojans are being picked up on my system. There are 3 copies of svchost.exe, in the system32 folder, and two in other places associated with download distribution. All appear legit. Microsoft copies, 14 kb, and signed. Why would Zone Alarm only just start to pick this up? ZA has not been updated from way before the time these alerts started appearing. Any ideas? Thanks!!

Well, you are definitely not alone. There are forum threads on users sites all over the place discussing this issue and the jury is still out on whether the recent Service Pack 3 is responsible for the recent outbreak of Zone Alarm alerts, or whether it is related to a recent automatic Zone Alarm update.

There are several threads on the Zone Alarm website related to this alert, and the consensus is that it is fine, doing its job and nothing to worry about. The address of a frequently used port by Windows also appears as an Internet port and so, sometimes, Zone Alarm will alert users when there is no risk. In your case, since you saw an IP address, you did the right thing blocking the request and should take the steps below to confirm your settings.

In your Zone Alarm Program Control list you will find something called Generic Host Process, this is the full name of the svchost.exe program. There should be only three green checks relating to this program: you should not allow permission for svchost to be a server for the Internet zone, but you should, and in fact must allow permission for it to be a server in the trusted zone. If Zone Alarm is notifying you that some unauthorized ports are trying to access the Internet, then it is doing its job and you should definitely continue to deny access.

It could be possible that there is an update available for your Zone Alarm software. To rule out this possibility, perform a manual update check. Open Zone Alarm and choose the Check For Updates option. Now, open the product interface for your Zone Alarm program and find the tab marked Overview. Next, select the Preferences tab, and then Check for Updates. If there is any new program code available for your product, Zone Alarm will find it now. There is a process to amend the details of an alert on Zone Alarm so that you don’t keep getting this notice. If you are interested in configuring the alarm, you can look for a process called ‘expert rule’ and add one to this notice.

The svchost.exe program coordinates - hosts - many applications and programs that run on your computer behind the scenes. Svchost.exe is an important program, and you want it to have some access, but you can limit its use so that it doesn’t take too much of the computer’s time or energy. The way to do this is to limit the number of programs that are set to run at startup. For this, click to open the Start Menu and select Run. A command box will open, then enter msconfig. In the next menu, choose the System Configuration Utility and then the Services tab. Now you will see a list of all the programs that are running every time your computer is turned on. You can uncheck to remove those that you don’t need, and select OK.