[Android Q&A, Help & Troubleshooting] evo8evolved:
Hello people,

Ive been running around these forums for a little while and I need some help. I have discovered some pretty nasty malware on my phone's. I have a fair amount of experience dealing with viruses and removal. This infection in particular I have been playing wacka-mole for a month now. What I can say is that its basically undetectable with antivirus. I am running a genuine windows 8.1/ubuntu 14.04 configuration. Alright...What I have noticed thus far for capabilities are the following.

Crossplatform windows/ubuntu/Android 5.0/5.1. This thing is infecting my devices over and over via wifi/bluetooth/nfc/usb/remotely? I watched an IDS system on a computer in the room I was in flag at my doctors office for intrusion. Im pretty sure my phone attacked the network. I was not connected. I know some of the code I read, it appears that my router has been attempting to act as a rogue access point. The permissions are very extensive for multiple "system apps" with a lot of custom permissions. Here are a few Links to the Virustotal results. Add the HTTPS...

virustotal.com/cs/file/292fe4d87dd4469b5df5a2e9d2314a990666c5cff71fa80fea8b618683bd58a7/analysis/1430186718/

virustotal.com/en/file/c13c177c87a2b2ad6324ed70d486ad1a15b21065255ec9892abd7717a4e8b417/analysis/1430187095/

virustotal.com/en/file/f789b243ee5c7f59b244d2ee77706be77147edc7aa3c1d99d64aa5579844d9e0/analysis/1430187984/

virustotal.com/en/file/24ddbc4b810ba3318df549ea55ee7253c5efe84d072f661bfe00608a201ba8b8/analysis/1430188026/

virustotal.com/en/file/f46768416bc7ca60bc5d3082da41ae272ae80f7e6b493af67bac9de6adab2400/analysis/1430188155/

I have noticed in the root many things I do not believe should be present. I have what I believe is CPU models for all phones and everything to go along to run this thing. My /sbin probably has almost 200 commands. /proc has 269 for app ID and inside are multiple files and folders. These include exe files and mutlple commands for various network protocols and network/device discovery. This are present in every folder.

My phone has been screen pinning every file execution. I stumbled across a folder that was actively storing screen shots. My phone has been making the sound as if it takes a photo of me when I "power it on/off." This stops when I put tape over it...haha I could go on and on about what this thing has done. Using TOR/Wifi/Mobile data when it wants, encrypting my twrp recovery after I pushed the file to the phone with Wugfresh Nexus 6 toolkit. All my internet traffic was being proxied. I can install a factory image but I cannot make it past the google log in, it acts like a bootloop but back to the wifi screen. I have tried numerous antivirus, manually going through root system and deleting files. Installs of CM install to /dev/block/platform/msm_sdcc.1/byname/system x2. Any suggestions on how I should go about trying to remove this would be appreciated. Ive been back and forth fixing computers and back to phones....with no success because I can't get the stuff off my phone.

My router had a seperate domain and multiple subnets/15000 hosts entries. Every couple of days I have to reinstall windows because its completely hijacked. Safe-mode doesn't even exist. Terminal commands for traceroute/MTR being disabled after a few queries.

Devices are Nexus 6, Gs5-tmobile both on ATT.

Thanks.

How many partions should I have?

ls -al /dev/block/platform/msm_sdcc.1/by-name and cat /proc gives me a total of 45.