I have a rooted device, with superuser rights granted to a few apps I trust. I have often found my `/system` or `/vendor` partition mounted read/write, and some files `chmod`ed to `0777`. Similarly directories/files with random names are created/deleted (e.g. `/sdcard/.a03Degpoif`), `.nomedia` files are created inside them to hide their contents from gallery etc.

`logcat`/`dmesg` contains no traces of all this happening in background. This doesn't happen periodically but in a slapdash way, internet connectivity isn't a condition either. I have tried disabling/uninstalling apps, looking for any suspicious processes running, but couldn't identify the culprit(s).

Is there a way to figure out who is doing this?