Pretty much that's what I had when I saw the issue. We tried everything you did. Different browsers installed, nuked java/flash, ccleaner, no malware to be found. User even had a restore point to a week before the issue.