Could you show us the list of extensions installed? That helps us to more or less identify if the malware came from the browser or the system.