A few suspects:

• Adware extensions installed quietly; review and remove unknown add-ons.
• Notification spam from sites allowed earlier; revoke permissions.
• DNS hijack or proxy set by a program; reset network settings.
• Bundled installers adding “helpers”; uninstall suspicious apps.
• Old profiles syncing the problem back in.

Need help? Check here: /services/computer-maintenance/

What it might be (likely causes)

• Extension hijack (most common)
  A single rogue extension can inject scripts or open tabs on a timer. Vet anything you don’t recognize. If symptoms started “after that free PDF tool,” start there. For a local case study: /posts/kirksville-virus-that-wasnt/