WARNING: Andy Android emulator (AndyOS, Andyroid) drops a bitcoin miner on your system : emulators

MAJOR UPDATE: I asked the Andy staff why they're still serving the infected file. After seeing that comment, and probably after seeing this reddit thread they've removed me from the group.

A friend opened Andy in process explorer to see the files it drops upon installation. By the looks of things, the installer isn't at fault. Andy itself calls an IP which then transfers the bitcoin miner to your system.

Andy clearly have no interest in fixing this issue and they're doing their best to censor it. At this point I wouldn't be surprised if this is completely down to their doing. The fact that they've completely blocked me from contacting them and the removal of all of my posts to them suggests that they don't care and don't want anyone to know.

Please keep in mind that this may not directly be Andy's fault. I'm not trying to directly accuse Andy of being at fault here but until an official statement is made from the Andy team I'm going to tell it how it is, and how the majority of people will see this situation. The installer Andy uses drops a cryptocurrency miner on your system and it has been reported in the past but no effort has been taken to cut ties with the company that created the installer. This is still Andy's responsibility. Funnily enough, the owners of Andy and the admins in the Andy support Facebook group actually recommend turning off your antivirus whilst installing.

All evidence provided on this post is true with version 'Andy_Nougat_260_1096_26' (latest release available from the official Andy website).

I was searching for an Android Emulator and came across an Android Authority list of the 15 best Android emulators for PC (now 14 after I contacted the writer of the article with evidence). I saw Andy was on this list and it was described as a big competitor to the likes of Bluestacks. I'd used Bluestacks previously but I was looking for a different emulator just to try something new. I downloaded Andy, installed it (I declined the offer relating to Yahoo), and began using it. I finished up what I was doing, closed Andy and opened some games. I noticed that in every single game I played I suffered major FPS drops at seemingly random times. I checked my GPU usage and temps and noticed they were working at roughly 80% load and 80+ degrees C whilst gaming. Very unusual for my setup. I opened task manager and sorted it via what was using the most GPU power and found a process named 'updater.exe'. After further inspection I noticed that this installed along with Andy.

I created a video showcasing the entire installation process, including GPU usage before and after Andy was installed. This was sent directly to the creators of Andy (which is who I'm referencing in the video), as they refused to believe that the bitcoin miner was anything to do with installing their software. Apparently giving them virustotal scans and screenshots are not enough evidence and some users in the Andy support Facebook group blindly tried accusing me and my friends of using a tampered installer. The video shows that I downloaded every single executable possible from their official website and I was served the same installer each time.

Removing Andy and the bitcoin miner is actually really easy. The miner doesn't even attempt to hide itself and doesn't have a specific payload so it's just always running.

Close every Andy-related process via task manager. Uninstall Andy via Windows Look for a process named 'Updater' (This is the miner and surprisingly enough won't be uninstalled when you uninstall Andy! Would you believe it!) Right click that process and click 'Go to details' Right click 'Updater.exe' in details and click 'End process tree' Navigate to C:\Program Files (x86) Click once on the folder named 'Updater' and then press Shift+Delete Click once on the folder named 'AndyOS' and then press Shift+Delete Recheck task manager to confirm no more Andy services are running Download Malwarebytes and perform a full system scan to check if anything was missed Download CCleaner and do a registry fix. Multiple Andy registry entries will be found. Delete these and scan again to ensure that nothing was missed

Why didn't my antivirus detect it?

The likelihood is that your antivirus probably thought you wanted it. If every antivirus detects bitcoin miners as a threat then it's only going to get in the way of people who genuinely want to mine bitcoins on their system for personal use.

The Andy development team claim they are 'looking into this', but it has been reported to them in the past and nothing has changed at all. It has been removed off of the list of best Android emulators by Android Authority after I contacted the writer of the article with this evidence. He also installed Andy and confirmed that something fishy is going on. Even after being provided with evidence, the infected installer is still served today from their website.

Someone working for Andy by the name of Ghazi has been urging people to stop spreading the claims that Andy installs a bitcoin miner by saying that Andy doesn't mine for bitcoins and that we've been using an older version, which uses a similar method as Andy requires something to do with blockchain technology. This makes no sense. I don't understand why a modified ROM and basic application that hooks into a virtual machine would require anything to do with blockchain technology. Another reason this makes no sense is that the OWNERS of Andy said that it shouldn't be there, and that it's not their fault because they use a third party installer provided by another company. Two very conflicting stories.

The installer for Andy also drops a bitcoin miner on your system

The bitcoin miner process (updater.exe) is always running

One Andy staff member claims that Andy uses blockchain technology and doesn't mine bitcoins which is why it was detected

Another Andy staff member (one of the owners) claim that the miner isn't part of Andy and was installed due to their third party installation file.

In summary, when you install Andy from their official website, you 100% receive a bitcoin miner.

I will update this post with any further advancements.

Edit: The thing Ghazi was talking about is a deprecated ‘Andy Cloud Experiment’ which is no longer in use. They are still looking into the current issue but are still serving the infected file.

Edit: After being banned from their support group I got in on another account. I made a post and when I told them who I was they instantly banned me again. Fantastic! Great guys! Professionals!