Thanks @blackbird71. It was AS (Acestream) Player extension, that once disabled, prevented the click to continue malware from running. Many thanks to all who commented! :):):) S