I have seen something like this, when it happens you don't always know what you did, or didn't do!

I have seen clickbait doing this. Websites deliberately scroll at odd intervals as you click over "next" only to find the pop-up layer has snook under the cursor.

Any virus described in the OP will be trading on this scenario. I usually look at the headers in e-mails, if you have a load of addresses (changed often) you get to spot most rubbish because they send to an inappropriate address like honeypot@caughtyou.com (eg).