Possible sources of repeated Adware infections

Question

In the last couple of months I have had the same thing happen on separate occasions to two Android phones, a Mac laptop and a Windows desktop computer. In all cases, something infects Chrome making random words on all sites becomes links to advertising, advertising tabs appear at random or when I click the mouse.

To my knowledge, I have not visited any websites I would consider dodgy, nor downloaded any questionable apps or programs, opened email attachments, or anything else on any of the infected devices. I don’t know how it happened once, let alone 4 times.

I keep all machines patched, and they are not linked other than being on the same LAN and using the same Gmail account. Almost all programs I have downloaded for the laptop and desktop are for scientific computing or web development.

What sources might I have overlooked, and what can I do to stop this from happening?

---

Additional info:

• Problem appears in Chrome only. I've checked Chrome extensions on PCs and all OK (do they even exist on Android)?
• Nobody else who has used the same LAN as me has the problem
• The problem appears intermittently on all devices - sometimes the same pages look OK and I can't find a pattern
• I ran Avast on my Macbook which complained about FileZilla, which I deleted. Problem appears to be gone now on that machine, but was intermittent to begin with so not 100% convinced.

Screenshot from Android:

Using the same connection, phone and browser I now can't reproduce this screenshot, so it's definitely intermittent.

Answer 1

I have not visited any websites I would consider dodgy, nor downloaded dodgy apps or programs, opened email attachments, or anything else on any of the infected devices.

From the scenario you described, you seem to be sure not to visit any web application that is likely to harm you.

There are two scenarii that may have been happened to you:

1. Nowadays, attackers have developed sofisticated methods: a simple visit to a given compromised webpage could lead to a drive-by download attack by exploiting your browser's vulnerabilities which are more frequently carried on by the extensions you install leading to spyware and adware (in the less dramatic cases) to infect your machine as it happened with visitors of Amnesty International's homepage on 2011 of which many users became victims.

2. Your LAN is compromised:

   2.1. Modification of home routers' DNS settings (Large-scale DNS redirection on home routers for financial theft).

   2.2. Your router is infected somehow (Linksys Worm "TheMoon" Summary: What we know so far)

For the situation 2, you can be sure of that if your colleagues (or users of your LAN) have experienced the same issue as you. If so, you could ask an other question providing more information.

For the scenario 1, remove your exentions one by one to see which one could cause you the problem. But I do not think this will be too useful if an adware is already installed in your computer, but still it is a good thing to do because after removing them all you will need to run a full scan over your computer. Once your machines are cleaned, change your behavior for the future: for examplebefore making the decision to install any plugin to your browser, you need to be careful by checking the permissions requested by its developers, and when you visit a webpage prompting you a message to install a plugin to be able to view its content then do not hurry to follow the instructions (for example if you have already the Flash plugin installed and the page asks you to install it then this is likely to be a drive-by download attack requiring the user's interaction). And as a general safety practice, never install a plugin unless useful and install as few as possible of them and verify if you can the behavior and source code of your extensions from time to time as it is done here.