windows 7 64 bit, possible browser hijack issue

hi, got a win 7 64 bit machine, using chrome as primary borwser. suddenly the user went the other day to use it, and it was taking them to the wrong yahoo site, and when they logged into the chase bank site, after they entered the username password, it brought them to a screen asking for ssn, dob, acct, etc....
also, all the chrome desktop links to site went white/blank.

i ran the anti-malware in safe mode, was clean. ran an updated trend anti virus scan, and found a virus it said it quarantined, but the browsers are still acting up.
i changed the system restore to disable, and ran the scans again, malware, housecall, trend agent local.
all seems good now, nothing found, but ...
ideas?
thanks
MarcHelfandAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Brian PringleSystems Analyst II, SCM, ERPCommented:
Check the add-ons for each of the browsers.  In Chrome, go to the menu | Settings | Extensions.  Trash any of the extensions that are not needed.

The next thing is to remove anything that has gotten into the network stack that shouldn't be there.  

Open an administrative command line (Start | type cmd | right-click on it and select Run as Administrator).  At the command prompt type the following.

netsh winsock reset

Restart the computer and see if that makes a difference.
Brian PringleSystems Analyst II, SCM, ERPCommented:
Fred MarshallPrincipalCommented:
Many browser hijackers don't get caught because they can appear to be user-added.  That's one possibility and it's already been covered here.

It's often advisable to use a number of different removal tools beyond the computer's own antivirus program:
Malwarebytes is a very typical first one.
RogueKiller
HitManPro
eset online
To be complete, use one after the other through the entire list.

If the problem persists then back to my comment about browser hijackers.

If the problem persists or is critical (as in this case) then make a special effort to detect Root Kits.
Preliminaries like TDSSKiller, etc.
So, you might start the process with these tools.
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

MarcHelfandAuthor Commented:
also, after a few seconds the ie browser goes to another tab as this:
http://localhost:14460/13078d57 ????
thanks.
ill do what you mentioned now
Fred MarshallPrincipalCommented:
I don't know exactly what that is but it suggests:

There is something accessible on the local computer at port 14460.
Block that port for outgoing and see what happens???
I'd still prefer the tools though...

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MarcHelfandAuthor Commented:
thanks, i just reimaged, but ive got some good s/w to download going forward, i got all the ones ya'll mentioned.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Web Browsers

From novice to tech pro — start learning today.