My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn't remember when or what he was doing).
In android 8.0 (the version of his smartphone) we can allow third-party installation for individual apps, so I went in this tab and I saw that only Google Chrome was able to this type of installation.
So, I navigated through my father's apps and found nothing suspicious.
When I went to files, I found a folder called didi. Inside, a file with no extension called psnger_encrypted or something like this. When I selected the file to see details, I accidentally clicked on the file. Android told me that there was not found any app to open that file.
Could a file have been executed even when Android says that message? If this file is malicious, it is possible that has executed and so infected the phone?
Doing some research, I found that a chinese app called "DiDi" has a file called "psnger" too. Also, I found a file in my father's phone called .omega.key, and this file is also seen in topics related to DiDi app.
The fact is that I can't find this app on the phone, and I'm looking for ways that can indicate if the phone is infected. I executed AVG, and Malwarebytes but both detected nothing. What else can I do?