[Q] How to remove this trojan? - Android Q&A, Help & Troubleshooting

Hi,
a cousin came to me with a problem about a trojan and now I have some questions to you:
All I know:
Some weeks ago I installed on this smartphone an app from F-Droid (Ghost-Commander) and to do so I had to tick >unknown sources<. After that I forgot to untick it again. About a week after that my cousin came to me with the smartphone and the 'trojan' on it (as you can see on the picture). She said that she only installed apps from the appstore.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
What the 'trojan' does:
A program is forced to foreground (as you can see on the picture) - it can't be exited. No key works. The status bar can be expanded but also clicking on the icons doesn't do anything. If the device is rebooted the lock-screen is shown first and when the device is unlocked then after about one to two seconds later the 'trojan' is executed.
What I did:
After some research I rebooted the device into safe-mode. The 'trojan' wasn't executed there and so I enabled android debugging. I couldn't remove any malicious app because due to safe-mode no suspicious app was loaded. After rebooting to normal-mode again the 'trojan' was back. I connected to the android shell with $adb shell and executed $top there. Then I started to force-stop suspicious apps with $am force-stop <package> and after some tries the 'trojan' was gone. I unchecked >unknown sources< und returned the smartphone to my cousin.
The problem now is that after some days the 'trojan' showed up again but now with a different package-name! (it was called edu.fluster this time)
View attachment commands.txt
Do you know
1) how this 'trojan' got onto the smartphone?
2) how it can be totally removed or if it was another infection how to prevented more infections?
3) how it is possible to write such a harmful program? I did some simple android programming and the sandbox that is built seemed pretty secure to me (as a novice) but how are such vulnerabilitiesfound? With much time? luck? knowledge? or all together?
I would be glad if you helped me!
piqJZu
EDIT:
I finally found the apps that start this trojan:
- 2 apps with the same name both are malicious - both show up as "Browser Update" in the menu
|-- one package is called: de.record.gauge
|-- the other: edu.fluster
Answers to the other questions are still appreciated