A good start would be to make it a criminal offence to sell the right to execute code on somebody's device without their consent. And to tax into oblivion any service that can't function without such consent.

We can work our way up to eliminating all targeted advertising later, lets start with the stuff that's indistinguishable from malware.