native mac malware opening urls across all browsers

I'm a security newbie so please excuse the solely high level symptomatic description of my problem.

My friend doesn't know how he got it, but he has some form of malware on his mac which, when he opens a URL, spontaneously opens an additional URL in a new tab. This occurs across all browsers so I'm guessing the malware is native. Anyone got pro tips for getting rid of it?

---

I was thinking of listing all running processes with ps aux, sequentially killing suspicious-looking ones while opening URLs, until the spontaneous URLs stop, and then use the path to remove the executable. But I'm inexperienced at discriminating suspicious ones, there are 153 running processes, and I guess removing the executable might not be sufficient if the malware is sophisticated enough.