[Galaxy S 4 Mini Q&A, Help & Troubleshooting] IronRoo:
ummm .... I was expecting it was just going to be a bad app serving ads, this is going to be hard :(

OK, that should rule out 3rd party apps (assuming you have avast set to find all PUP/PUA, etc & nothing white listed) but not finding anything may mean malware is embeded in ROM or malware was able to open port on your system but then uninstall itself or just that there is a line of code that points browser to a server that is serving adware so antivirus is not finding it. Some malware is able to hide from anti virus software in different ways. Try this app, it is not true antivirus, you run it manually, don't worry if one or two antivirus companies like white armour identify malware, they do often even on clean phone.

https://play.google.com/store/apps/details?id=com.funnycat.virustotal

You can also submit any unknown app to virus total white this app for testing. Also you must submit the bad url your browser is connecting to for testing, this will help it spread to all anti virus database.

Good news is you do not appear to be rooted. But the ROM you flashed may still be bad. Where did you get the stock ROM you flashed? I would only use a trusted source like sammobile.com/ but even that is no guarantee. You could try flash another ROM, though as this happened on previous ROM it's probably a good ROM, unless you are getting all your ROM from same site that is not well known as trusted.

So that would suggest they are able to get easy access to your phone either via your google account, cloud service, local network at home/work/public, or through your modem/router.

Check your local network doesn't have a neighbour or other unknown device connected with this app Fing

https://play.google.com/store/apps/details?id=com.overlook.android.fing

Of course even if you recognise all devices that doesn't mean your brothers etc phone is not the source.

Do the same with other networks you have access to.. Talk to work, any one else infected? Change you password. If using public wifi always use a vpn.

Likely source is your modem/router, Log into your modem router check for updates for it, (if old and not supported you may need a new one), update or if latest firmware do a factory reset, now reboot and use a new password (do this at the same time you reset ALL your passwords, or you might just allow them to find new passwords and reinfect you)

Check your goggle account does not have someone else set for account recovery and/or two factor authentication. (set it up if not already on) Change password and ALSO change password on any other recovery account (write them down :p)

do the same for cloud storage, and scan storage for virus if possible eg dropbox local folder on pc. Unlink cloud storage from mobile until you are clean to block this route of reinfection.

Update any other device software & change passwords eg xbox, printers etc

I think there's something I'm forgetting :eek:

Now reflash stock ROM ( I would also suggest then flashing an up to date custom ROM with most recent security patches)

Things you can do that may help temporarily .....

Install a firewall app like netguard and block internet access to browser, through may not work as root etc is open by default. Oh yes, that reminds me of one thing I forgot, check your DNS has not been hijacked, netguard shows dns url in settings, change if you cannot find who dns server your phone is using, use google 8.8.8.8 & 8.8.4.4 if you don't know what to set.

Use an app like Link2SD, Titanium Pro to freeze apps, but you will need root for this.

It's a lot of work (& I think there is something I am forgetting), you may get away with just factory resetting your modem or something as it appears to just be adware so they probably don't have access to your accounts etc, but I tried to cover everything.

Hope I'm making sense through goggle translate!