What is the best practice to deal with suspected malware infections in Lineage/Android?

Question

I have reason to believe that my Lineage OS (14.1-20180620 nightly build) may be infected with malware. How should I deal with this?

Other questions recommend running Malwarebytes. A question asking about typical malware techniques did not receive an answer.

Details:

With K9 mail I opened an Email that contained what appeared to be a png image and a link to a jar file (yniaaa.jar) hosted on doko.moe (an url known to be used for malware distribution) but showed only plain text (and not very much of it). This was followed by strange behavior of the K9 mailclient (it did not show all emails any more; in the webmail interface all emails were still present). A google search for any of these details (file name, url, sender email address (probably forged, but still)) does not turn up very much.

I do have a backup of the email (But I do not know how to investigate it safely).

Possibilities:

• Uninstall K9 (obviously)
• Change all passwords (obviously)
• Wipe everything, reinstall everything (disadvantage: it is inconvenient and currently impractical)
• Find out what kind of malware it is and what it does since it may have sent emails in my name before the password change took effect? (disadvantage: I do not know how to do that.)
• Run Malwarebytes (disadvantage: will this find and remove everything?? I do not know how it works. EDIT: I also do not understand it. In my case it does nothing besides running a really really dumb animation and show a welcome screen.)
• Remove any leftover data of K9, reinstall then (disadvantage: 1. I do not know how. 2. Lineage itself may be compromised. I do not know anything about malware on Android/Lineage. From the abscence of root passwords etc, I assume that security standards are in general very very very low.)
• Inspect the system with adb (disadvantage: I do not know how)

Versions Lineage OS (14.1-20180620 nightly build); K9 mail: version unknown (I uninstalled it before I thought of checking the version number. I do not know how to check the version number after the uninstall is complete.)

Answer 1

Run Dr. Web Security Space Antivirus in full scan on your lineage. If it does not say there's a malware trust me there isn't. After that check what it recommends. Ignore only Google Play Services Adware warning

In order to wrap things up easily. When we look at a virus that can cause a computer or a phone to totally turn into nothing but a brick, then we surely mean a virus that can modify system components and hence cause system to malfunction.

Windows OS to start with, has an ability to enable programs to run as Administrator and hence can modify the system files like installing device drivers, accessing keystore and configuring hardware devices. If you're logged in as an administrator and you have explicitly allowed programs to run as administrator without prompt, you may be vulnerable to have programs with ill intentions to modify system components. We call these malware if they delete, replicate and hide files.

Talking about Linux based OS, specifically on computers like the Mac, Ubuntu, Resurrection etc, the administrator rights are granted by the SuperUser script which works after being initialized at boot by its daemon. This is just like a rooted android where an app can configure and access the root file system and execute system shell commands like removing, downloading data into a partition and creating file systems. Applications can use these to delete essential files like the framework files and hence spoil your Linux PC.

Lastly, we all know Android runs a modified Linux Kernel which means SuperUser rights can be granted by rooting. This way the ability to modify the system is possible but only by explicitly granting the rights by allowing root manager to allow the app to gain root access and modify the system. These are the only ways to brick a phone or PC. But naturally Android is not rooted by default and it makes it harder to get bricked. The only type of problem we have in android is apps that popup adverts and that just irritates us but has no harm to the system.

I have noticed very well that some third party Androids come with pre-installed apps that can install other apps. This is enhanced by a main app at /system/app or /system/priv-app/, a framework file to render advertising UI and install apps at /system/framework/, a script for installing apps, at /system/bin or sbin and a library to support its main app at /system/lib/. I have seen this evident in some fake Sony phones but after running Dr. Web Security Space, it can identify all of them then you can root and delete them to avoid these ill behavior.

Please note that Google Play Services will be listed because they can popup adverts above apps but just ignore this since these are essential services for entire Google apps

Why Dr. Web Security Space? Here I have tried a lot of antivirus software on android and surely many of them scan application permissions, known apps to cause problems. This doesn't go beyond discovery of apps that can access private information and what apps are known to cause things like ads and basic perceptible things. Dr. Web goes around scanning system apk files. Treating each as a zip archive and scanning their code and data and assets each to see what they can cause. This makes it able to discover even apps at your memory card which are not installed whether they are harmful or not. It scans framework files each as a jar archive to know what harm they can do and thus discover them. What does it mean. This software first tends to know what type of file is a file regardless of its file extension or name then scans in it file by file through code texts and through archives and through executables to know their harm. So it's the best I can recommend. It even shows you what it's scanning in a file and exactly what is harmful and recommends the best action. I don't think there's anything out there that does all these