How does one reset the knox counter so I can update as normal via Samsung update
You cannot reset the Knox counter once it has been tripped I am afraid, otherwise it would be pointless as a security feature. In fact, there has been a reward of over, currently, $3,000 for the last year for anyone who can successfully reset it. See,
here.
I've only got cm recovery, rooted rest is stock but say I'm modified I'm guessing it's the recovery that's caused this?
You are right, both towelroot and CF-Root will not trip Knox or affect your ability to update
usually. However, a custom recovery or a custom ROM will trip Knox and prevent updates via Kies and OTA,
normally.
As only just got to rooting and it gave same modified before I did so (altho had tried towel root which does not work on the s5 but maybe did something)
Any ideas thanks?
If you wish to update to a stock Samsung firmware, you can do so by downloading it from, say,
SamMobile and flashing it via Odin. The Samsung stock firmware contains a stock kernel which will unroot you and you will need to re-root again.
For more information on Knox, see,
Knox Security & locked bootloader on new firmwares