Go to settings > application > running services and look for anything that shouldn't be starting up unless needed. My gf had this issue with a Christmas live wallpaper because she didn't check the permissions on the apps she was installing...
The way i found it was by installing another browser besides stock (opera mobile and mini) and never set any to default. When the malware tries to open an ad, you will see the app name in the title bar, while it waits for you to choose a browser to open the ad with. Always make sure you check permissions before installing anything. If it needs your contact info, sms, internet, etc. make sure you know why. Good Luck!
Edit: also install lookout mobile security or another antivirus app