Windows Defender Help

Internet Explorer Home Page Resets to Blank and Windows Defender Quits

You may encounter the following problems on your Microsoft Windows 2000, Microsoft Windows XP, or Microsoft Windows Server 2003 computer:

• Windows Defender tool unexpectedly stops working.
• The home page of your Internet Explorer automatically resets to "about:blank" without your consent.

Cause of the Error

When this happens, it indicates, that your computer is infected by malicious Trojan horse program named TrojanSpy:Win32/Banker.

Resolution Steps

Most of the antivirus tools available today are equipped to detect and remove this virus from your computer. Therefore, the best way to resolve and prevent this problem is to perform a full system scan using an updated antivirus tool. After the virus is removed, reinstall Windows Defender on your computer.

Additional Information

TrojanSpy:Win32/Banker is installed on your computer as an Internet Explorer Browser Help Object (BHO). After infecting your computer, the Trojan, performs the following on your computer:

• Resets home page of your Internet to "about:blank."
• Deletes all the files in the C:\Program Files\Microsoft AntiSpyware folder.
• Searches for open windows related to Microsoft Windows AntiSpyware (Beta) and closes them.
• Shuts down all processes related to Microsoft Windows AntiSpyware (Beta).
• Tries to download and run updates from a Web server on your system.
• Tries to download and run unwanted software from an FTP server.
• Prevents you from accessing certain security websites.
• Removes the gcasServ registry entry from the following registry subkey:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

• Collects personal user information when you visit online banking sites and attempts to send it to an external FTP server.

• Logs the URLs of the Web sites you access to the %windir%\Req.log file. The Trojan however, fails to log certain URLs.

To ensure that you computer stays free from TrojanSpy:Win32/Banker and other viruses and Trojans, you must scan your PC using an antivirus tool that is updated with latest signature files (virus definitions).