Browser Jijack?

[UbinTook]

Issue, Samsung s2 android 4.1.2 on Tmo
My wifes phone keeps popping up a dialog to choose a browser( thats not the issue, she hadnt set a default), but the problem is its popping up randomly, pretty often trying to open this page( which i allowed it to:

I copied the address it trying to reach
Code:

h t t p:/ /w w w.androidsecurityfree.org/v3e/index.html?version=locked-suite&wwd=2&page=aa.matt.5svp.0830&split=1390677a& ccrule=33cbf077&offer=aa.matt.3tfi&product=anti-virus&partner=nb&country=us&language=en&pool=e7cd2 767&pop=0&affid=184772&subid=&subid2=OjU6NDg6MTY6A mZzJHUgYKBh7H9Rbw-2mDHW81APED2pdCwdvg7Qv0C5GiYo97THjC_rDk8yLfcrE48du rZ5pRNnwtMSrz8ARw&shortcut=aausnb&ipcc=us&iprc=ca& xsid=l1S4xXuJnUuv3ETpaJZz4g&ccconfigid=348fbd4

The issue is continues regardless of reboot, close out the browser, clear cache/data. it keep coming back
She has the free version of lookout installed and it doesn't find anything.
any clues as to what is happening?
Sees like a hijack of some sort..

 

[Hadron]

Has she scanned for apps that use push advertising? Browser redirection is one of the evils that's been reported to produce. As it's not technically malware you need something other than Lookout's security product to find it - they do have a separate scanner for this, and there are other apps that can detect it. See http://androidforums.com/android-ap...s-unwanted-shortcuts-browsers-redirected.html.

 

[UbinTook]

thanks, ran the lookout ad network detector and found a common theme...Draw Free.
Uninstalled it.
Ran addons detector and it came back as clean.
We shall see how it progresses.

 

[UbinTook]

ok...something is up for sure. I wiped my phone and reflashed a stock ROM from XDAforums that was debloated and deodexed etc.
Its been working fine for days suddenly today the same popup appeared, this time its green.
WHAT is going on, i havent installed anything...
EXCEPT swiftkey 3..
uninstalled and watching.
so far no popups