{"id":139743,"date":"2025-04-29T13:24:47","date_gmt":"2025-04-29T16:24:47","guid":{"rendered":"https:\/\/www.mobilegamer.com.br\/?p=139743"},"modified":"2025-04-29T13:24:47","modified_gmt":"2025-04-29T16:24:47","slug":"winlator-is-accused-of-containing-a-virus-and-has-its-development-halted","status":"publish","type":"post","link":"https:\/\/www.mobilegamer.com.br\/en\/2025\/04\/winlator-is-accused-of-containing-a-virus-and-has-its-development-halted.html","title":{"rendered":"Winlator is accused of containing a virus and has its development halted"},"content":{"rendered":"

The Winlator<\/strong> Windows emulator for Android has had its development paused after accusations that it was infected with a virus. The issue exploded on Reddit<\/a>, and the developer, BrunoSX<\/strong>, decided to halt development after receiving threats from the community.<\/p>\n

\"\"<\/p>\n

What happened to Winlator?<\/h2>\n

On Sunday, users discovered that Winlator might contain a version with malware inside the Test3D.exe<\/strong> file, which, according to reports, was infecting other .exe files within Winlator itself, rendering them inoperative.<\/p>\n

\n

To be clear: the alleged virus occurs during runtime inside Winlator’s containers, with no risk of “leaking” into the Android system.<\/em><\/h3>\n<\/blockquote>\n

The malware in question would be Win32\/Floxif<\/strong>, a backdoor-class malware that, in theory, could leak information from “Windows.”<\/p>\n

However, most users employ Winlator solely for gaming, making it unlikely that the malware would have any practical use or could even connect to the internet.<\/p>\n

The real problem is that this virus could start infecting other .exe files within the Winlator container (but only while Winlator and the container are running).<\/p>\n

\"\"
Virus allegedly corrupting Winlator containers<\/figcaption><\/figure>\n

 <\/p>\n

The image suggests that Win32\/Floxif<\/strong> would be corrupting and creating random infected .exe files, indicating it is a real virus and not just a “false alarm” from antivirus programs.<\/p>\n

What the Winlator developer says<\/h2>\n

Interestingly, some Android antiviruses managed to detect this malware, but under another name. The issue had already been raised on Reddit<\/a> and often resurfaced with the question: Is there a virus or not?<\/p>\n

According to the developer BrunoSX, it\u2019s a false positive (see here<\/a>).<\/p>\n

Despite that, the reports are old, and the more recent versions of Winlator do not<\/strong> contain Win32\/Floxif<\/strong>. Even so, after receiving threats from the community, the developer BrunoSX<\/strong> decided to pause the project.<\/p>\n

He left the following statement on the project’s GitHub page:<\/p>\n

Hello everyone, I have been working on Winlator for quite some time, more precisely since June 2023, and I have decided to pause the development of the project for now. I am a person who works alone and do not have the strength to defend myself. In the past two days, accusations and attacks against me about viruses in Winlator have started to appear, which made me very upset. I always verify the files before each release and work hard to deliver a quality app, and I would never put a virus in it. This is a project into which I pour my heart, and I do not earn much from it; what I receive in donations is just to cover costs, and I don’t think the stress is worth it anymore. I thank you all from the bottom of my heart.
\n\u2014 BrunoSX<\/strong><\/p><\/blockquote>\n

What could have really happened?<\/h2>\n

(Just to be clear: this is merely my supposition, ok?)<\/p>\n

 <\/p>\n