Suspect date of event was on 2016-11-11, or just before.

We began monitoring closely the suspect laptop and noticed things.

Our last known good backup was on 2016-10-10.

We knew something was going to happen.

Culprits in crime could have been an Ad hack or Click bait.

We suspect Facebook, we've seen it before.

Other sites have been flagged potential vectors.

It's a good idea to have an expendable laptop to view sites.

Norton as of late, has excellent intrusion prevention, don't click those pop ups as those X's aren't X's they sometimes are script executes that do not truly close the pop up, but download crap.

Whatever it was, we think it came through Firefox as a javascript.

We caught it a few times before, but must have worked it's way around.

Seen it a few times as a sneaky sleazy update made to look like something legit.

"don't click those pop ups as those X's aren't X's they sometimes are script executes that do not truly close the pop up, but download crap."
_______________________________
I did not know that.
What am I going to do now?

Actually, we use the Task Manager to kill any application we don't like or seems wrong.

Still, I think it snucked by somehow.

Think it was while we were not at the laptop; just sitting on Facebook.

You know, when it does a refresh of the Ads, wink-wink.

Alt-F4 try it.