Never rooted device status shows as "Modified" - Galaxy S III Q&A, (US Carriers)

I seem to have an odd problem. For some reason I first noticed that after some use on my phone that that upon rebooting the device and on the first boot screen that shows "Samsung" there is a lock icon with it being unlocked with the text "Custom" below it at the bottom. I have never rooted my phone after a week of having it. Later, I did a factory data reset which cleared this problem but however the same issue came back. I simply just decided to deal with it as I could not find much information on the issue.
Fast forward a week later to today I discover under the "Status" menu that my device status says "Modified" which I believe is connected with the "Custom" thing being displayed on the boot screen. Again, I've never rooted this phone and any information I can find deals with people that have or previously have rooted their phones.
Device information:
Carrier: Verizon
Model: SCH-I535
Android version: 4.0.4
Kernel version:
3.0.8-618049-user
[email protected] #1
SMP PREEMPT Fri Jun 15 07:53:02 KST 2012

---

Curi0us said:
I seem to have an odd problem. For some reason I first noticed that after some use on my phone that that upon rebooting the device and on the first boot screen that shows "Samsung" there is a lock icon with it being unlocked with the text "Custom" below it at the bottom. I have never rooted my phone after a week of having it. Later, I did a factory data reset which cleared this problem but however the same issue came back. I simply just decided to deal with it as I could not find much information on the issue.
Fast forward a week later to today I discover under the "Status" menu that my device status says "Modified" which I believe is connected with the "Custom" thing being displayed on the boot screen. Again, I've never rooted this phone and any information I can find deals with people that have or previously have rooted their phones.
Device information:
Carrier: Verizon
Model: SCH-I535
Android version: 4.0.4
Kernel version:
3.0.8-618049-user
[email protected] #1
SMP PREEMPT Fri Jun 15 07:53:02 KST 2012
Click to expand...
Click to collapse
It could just be an app you installed. The ROM periodically scans for "rogue" apps (like busybox (which you need root for anyway)), so, start up logcat and be on the lookout.

---

Any keywords I should look out for in the log that will help me find out why my device status is being thrown to "Modified"?

---

Curi0us said:
Any keywords I should look out for in the log that will help me find out why my device status is being thrown to "Modified"?
Click to expand...
Click to collapse
For example:
Code:
W/SysScopeService( 861): DANGEROUS_FILE_DETECTED: /system/bin/busybox
So, running "adb logcat|grep SysScope" might help pinpoint it. Might have to run it for a long while before it scans again, so do the logcat right after bootup for quicker results.

---

Interesting, it appears to be my 64 GB microSDXC card I have in the device.
This hinted it was my SD card:
Code:
D/DeviceInfo( 535): Trying to connect to SysScope Service
D/EnterpriseSysScope( 914): onCreate()
D/EnterpriseSysScope( 914): onBind()
D/DeviceInfo( 535): SysScope Service connected
I/SysScopeService( 854): add service
I/SysScopeService( 854): registerAlarm, interval:86400000
W/SysScopeService( 854): onCreate
W/SysScopeService( 854): onStart Intent { cmp=com.sec.android.app.sysscope/.service.SysScopeService }
W/SysScopeService( 854): onStart Intent { act=com.sec.intent.action.SYSSCOPE flg=0x4 (has extras) }
I/SysScopeService( 854): periodic:true
W/SysScopeService( 854): setState state=1
W/SysScopeService( 854): handleMessage
W/SysScopeService( 854): current state = SYSSCOPE_STATE_INIT, next state = SYDSCOPE_STATE_RUN
W/SysScopeService( 854): setState state=2
W/SysScopeService( 854): handleMessage
W/SysScopeService( 854): current state = SYDSCOPE_STATE_RUN, next state = SYDSCOPE_STATE_DONE
W/SysScopeService( 854): OnJobProgressListener.onStart: total = 5, listener=0
I/SysScopeRootScanner( 854): isUnapprovedRootProcess returns true: 1303
I/SysScopeDiagnosisManager( 854): SysDiagnosisManager > call storeResult2
I/SysScopeDiagnosisManager( 854): SysDiagnosisManager > storeResult:1
W/SysScopeService( 854): OnJobProgressListener.onFinish: true, info = Mon Jul 16 11:43:34 PDT 2012
[B]W/SysScopeService( 854): ROOT_PROCESS_FOUND: fsck.exfat [/B]
W/SysScopeService( 854): setState state=3
W/SysScopeService( 854): handleMessage
W/SysScopeService( 854): current state = SYDSCOPE_STATE_DONE, next state = SYDSCOPE_STATE_NULL
W/SysScopeService( 854): setState state=0
W/SysScopeService( 854): handleMessage
W/SysScopeService( 854): current state = SYDSCOPE_STATE_NULL, next state = SYSSCOPE_STATE_INIT
D/SysScopeService( 854): SysScopeService : send status Intent
Upon taking the card out and rebooting the device the device status shows "Normal" along with a difference in the log:
Code:
D/DeviceInfo( 533): Trying to connect to SysScope Service
D/EnterpriseSysScope( 927): onCreate()
D/EnterpriseSysScope( 927): onBind()
D/DeviceInfo( 533): SysScope Service connected
I/SysScopeService( 858): add service
I/SysScopeService( 858): registerAlarm, interval:86400000
W/SysScopeService( 858): onCreate
W/SysScopeService( 858): onStart Intent { cmp=com.sec.android.app.sysscope/.service.SysScopeService }
W/SysScopeService( 858): onStart Intent { act=com.sec.intent.action.SYSSCOPE flg=0x4 (has extras) }
I/SysScopeService( 858): periodic:true
W/SysScopeService( 858): setState state=1
W/SysScopeService( 858): handleMessage
W/SysScopeService( 858): current state = SYSSCOPE_STATE_INIT, next state = SYDSCOPE_STATE_RUN
W/SysScopeService( 858): setState state=2
W/SysScopeService( 858): handleMessage
W/SysScopeService( 858): current state = SYDSCOPE_STATE_RUN, next state = SYDSCOPE_STATE_DONE
W/SysScopeService( 858): OnJobProgressListener.onStart: total = 5, listener=0
Looks like it doesn't like exFAT. Additionally the "Custom" indicator on the phone goes away if I reboot once more without the SD card. Thanks for the help.

---

Interesting. You have (or had) a "fsck.exfat" executable file on your external 64GB SD card? My 64GB Sandisk didn't come with any pre-installed crap on it; was just cleanly exFAT formatted.

---

You're mistaking an essential system process that is for use for checking file systems for a program that may have been included on my card. My card is also a SanDisk and was clean on first use.
fsck.exfat is a file system checking program which is a shortcut for fsck -t exfat. fsck is found on Linux systems as well.
Upon booting my device my phone will check the file system of my SD card for any errors.

---

Curi0us said:
You're mistaking an essential system process that is for use for checking exFAT file systems for a program that may have been included on my card. My card is also a SanDisk and was clean on first use.
fsck.exfat is a file system checking program which is a shortcut for fsck -t exfat. fsck is commonly found on Linux systems as well.
Upon booting my device my phone will check the file system of my SD card for any errors.
Click to expand...
Click to collapse
fsck.exfat is a false positive then, since we all have it, and your extSD card had no "dangerous" files on it. keep lookin'
(and I know what fsck.fubar is for. (I've been using linux and *bsd as my primary OS for almost 20 years))

---

When I take my SD card out and reboot my device status shows as "Normal" and after a second reboot the "Custom" indicator disappears. That's the evidence I found with logcat. There really isn't anything else to look for.