Start by booting into safe mode and running virus scan from there. You should also be able to retrieve files from this setup. Do this while not on internets.

It's possible that someone hijacked an ad from the site or hijacked the site itself to do datamining. It happens all the damn time.