Can I get some help with a malware issue on my Samsung S4?

[Smsny]

Need someone smarter than AT&T to figure out malware issue on Samsung S4

Awhile back I may or may not have click on a "fake google play store" and possibly updated an app. I don't know which one. Something hijacked my certificate approvals and is giving them to apps that look like they are legit but are not. After lots of trying I took it into my service provider who tried a factory reset which did nothing. My phone was sent into AT&T and my SIM brand new SD card trashed. I received a completely new phone (same model) sometime later and was given a new SIM card. They kept my same phone number. At first it SEEMED okay, but I was a little skeptical of the AT&T update running constantly in the background and a few other weird things. I used it slowly to see if it was really fixed. I even made a new gmail address (because you need one for everything). Adding a gmail account to the phone seemed to make everything go to crap again, even before I did anything with it. I removed the google account and did a factory reset but problems remain.

Some of the more serious issues have been:
bogus certificates giving insane permissions to lots of random apps
not being able to disable/truly stop apps (if I do they usually pop back up or run in the cached processes i.e. background)
having the camera, microphone, wifi, screenshot functions act on their own (it's a real safe feeling)
I'm unable to use the Security setting "verify apps" or "Clear credentials"

I've only had this phone since this fall and it's been a nightmare. I'm not stupid about web stuff and am probably more careful about security type stuff than most people (never used a credit card on it, installed facebook, etc.)

Allegedly I'm running Android version 4.4.4. I have some other crazy stats if that will help. Running a software update previously didn't work because 'this thing' has control of that too.

This is a lot of b.s. for a phone that isn't even considered close to new anymore.

Help!

 

[Rukbat]

Re: Need someone smarter than AT&T to figure out malware issue on Samsung S4

First - a new phone won't have the same malware as the old one, so unless they copied everything from your old phone to the replacement, it's not a malware issue.

bogus certificates giving insane permissions to lots of random apps

There are too many causes of that to even make a wild guess without a wireshark log of a few hours of use.

not being able to disable/truly stop apps (if I do they usually pop back up or run in the cached processes i.e. background)

That's how Android works.. If it needs an app running and you kill the app, Android will rerun it. That's why "RAM cleaners" and RAM boosters" are nonsense, and just waste battery.

having the camera, microphone, wifi, screenshot functions act on their own (it's a real safe feeling)

Defective phone - can't tell from here if it's hardware of software.

Bring it into an AT&T Device Support Center. You don't say when you received the replacement, but they may still do something for you if it's out of warranty, just because it's such an intriguing situation.

A new (refurb, of course) phone and a new SIM card (and don't use your SD card) shouldn't have any problems. So I'm guessing that either it's they copied as much as they could from the old phone [including malware], the SD card is infected, the SIM card isn't a new one and it's infected or you're going to a seemingly safe site that's not safe. (I don't believe in magic or other woo - there's a rational explanation.)