My Samsung Galaxy S3 Sprint was hacked a couple of weeks ago. This happened after all of our laptops were hacked as well. I have strong evidence to support all are now hosting botnets. I THINK I could fix my phone if I could get it wiped. However , wiping via Clockwork Mod , Factory Reset, etc...leaves me with files and folders that should be wiped.
I recall seeing some config file which stated "allow factory reset" = false. I was able to make some progress by installing CyanogenMod until updates ran which put me back to square one. I can't download GApps but managed to get the Amazon Appstore. Other than that, I have fake system processes running. Such as "System UI" but when you open it up it says its actually "android.keylogger". You can kill all processes and it still run so I'm assuming the real ones are hidden.
I've found the complete root file system in three places and it appears I might be mounted to their network or system. My firewall shows constant connections between three different "companies". Same with the computers. If you block the app they are coming in through, they then say they are another app. Such as Akamai Technologies via the Amazon app. I block it and then that name and IP range starts coming through as Sprint or CyanogenMod. I've looked up all IPs and most come back linked to a backdoor trojan /spy network.
My question, is there somewhere I can view the internal filetree so that I can compare? If I could see what doesn't belong, I should be able to get this under control via the terminal or Linux. Before anyone asks, every virus grogram has been ran. The actual virus is gone. I'm left with the bots and a screwed up filesysrem. Once I find a way to actually wipe the device, the little nightmare bots should go too. This is 100℅ driving me nuts! I'd appreciate any help!