The Winlator developer has paused its development, citing community backlash over user reports of viruses being found in the app’s TestD3D.exe and spreading to programs created by the emulator.
Winlator is one of the most utilized apps on Android-based retro handhelds as it allows for easy and somewhat seamless emulation of Windows, making it possible to play games like UFO 50, Tembo the Badass Elephant, and older point-and-click adventure games that can only be distributed as .exe files through Steam or other various storefronts. Winlator makes it possible to use the game’s PC-based files to effectively make them playable on Android handhelds.
Late yesterday, a report broke that Winlator was impacted by a virus called Floxif that can infect exes within the environment created on the device. The virus was found in the app’s TestD3D.exe file, which is downloaded and within the program’s packed APK. But it is only fully utilized when using the app to create containers that would then be used to play games in the emulated environment.
Report thanks to TheKingFireS
After reports were shared of the virus’ presence in core files from Winlator, it was found that the virus had been previously reported by members of the community days earlier, but was quickly dismissed as a “false positive.”
Somewhat luckily, if a user were to, for example, create a Windows instance to play UFO 50, the .exe for the game may be infected with the virus. However, despite where the game may be saved, the virus would not corrupt, alter, or affect any neighboring Android downloads found in the same folder, higher-level folders, or system files. The virus is a commonly known Windows Trojan that infects and corrupts other .exe files.
What is Floxif?
The virus, on an Android device using Winlator, mostly operates offline. This, in a silver lining of technological hope, means there should be no worry or implication of the app potentially sending user data to otherwise unknown sources or proxies — it’s simply a destruction-first virus. Floxif, on a computer, can be used as a backdoor for other more malicious malware; however, if you’ve used Winlator to create bootable programs on Android and moved those programs to your PC, you should take immediate action.
Windows Defender quick rundown of Floxif
In 2017, Floxif made headway in the wider tech arena after being found in a version of CCleaner’s build files following the development company being purchased by Avast. Ironically, as CCleaner is an app used to delete duplicate files, clean up temp folders, and ultimately help remove viruses or other bad actors in a PC environment, the existence of a Trojan in the app affected over 2.7 million users who believed they were doing their due diligence to protect themselves.
That being said, it is currently advised to uninstall Winlator from your Android handhelds and wait for a potential fix to be distributed. Ironically, with development taking a break, it may be quite a while before we get our hands on a solidified fix to the problem.
Winlator Development Takes a Pause
Bruno has announced via the project’s Github page that he will be taking a momentary pause on development of the app. Having started in 2023, and the rampant success of the app following shortly afterward, the seemingly instantaneous switch between adoration and hate from the community can only be summized as jarring to some developers. At the same time, the community should always take an active role in reporting any problems or issues they encounter within the apps they use.
Bruno states that the program has been a passion project of his since its initial inception, and that any virus found within the code of the app is absolutely unintentional.
The question then progresses to how the virus can be within the source files, infecting current installations of Winlator, and spreading if not put there purposefully. But the way the virus spreads explains how, without much fanfare laced between. The virus infects .exe files, finds other .exe files, infects them, and continues to spread. It being found inside of Winlator installations on Android devices more than likely stems from the virus impacting one of the PCs being used to develop the app.
Keep Your Winlator Installation Safe Today
If you’ve created bootable programs within the app, moved those .exes or programs to your computer, then you may want to run either the native Windows Defender anti-virus app or find a worthwhile 3rd party anti-virus solution. However, given the speed at which the virus spreads on Windows based platforms, it’s probably a better idea to do a full reinstall of Windows and forgo relying on any backed up or saved .exe files.
Floxif is a Trojan virus, one that spreads relatively quickly when it’s able to. The benefit for Android devices is that the Windows containers created are mostly contained within themselves. Users impacted should be able to delete any created containers to remove the virus and be on their merry way.
In the time that the initial discovery was made, Bruno released a “Hotfix” for v10.0 of Winlator. According to the changelog, it includes “updated/recompiled internal programs: wfm.exe, winhandler.exe, and GPUInfo.exe.” As such, you should have no problems downloading and installing the latest build.
A pause in development does not necessarily mean Bruno has abandoned the app for the time being, but — purely as an assumption — it could mean his focus is on making a fix for the related virus, but pausing any development on other fixes, tweaks, or new features that were actively being worked on. Again, an assumption, but a safe one to make given the app’s history.
Winlator has been a crucial app when it comes to getting the most out of Android handhelds, powerful enough to run apps that would otherwise only be available for PC gamers. The discovery of the Floxif virus being present within the app, the community response to it, and the eventually suspension of development have all happened in a relatively short period of time, but since Winlator 7.1 onwards has been closed source, our best hope for a solution falls squarely on Bruno and any development he may push towards fixing it.
What did you think of this article? Let us know in the comments below, and chat with us in our Discord!
This page may contain affiliate links, by purchasing something through a link, Retro Handhelds may earn a small commission on the sale at no additional cost to you.