Your safest option with a previously owned phone is to flash a Samsung stock ROM and do a Factory Reset. This will ensure that the operating system is returned to a clean, un-rooted state and the data partition, where all your personal stuff gets stored, is also clean.
If you post the model I.D. of your S6, your carrier, which version of Android it's running someone here can help you through process of flashing the ROM, or you can take it to a trusted, local service shop.
As for your initial query regarding if a Factory Reset will remove things like spyware and viruses, that's a conditional matter. If the exploit itself exists in the user's data partition than yes, a Factory Reset will clear it. If the exploit has compromised something in the operating system than no, a Factory Reset won't affect it at all. You'll need to re-flash the ROM to remove an infected operating system.