Interloper runs 20+ read-only checks a technician would take an hour to do by hand - miners, bandwidth-selling proxyware, remote-control backdoors, hidden accounts, every trick malware uses to survive a reboot - and gives you one verdict in plain English, with step-by-step fixes written for your PC.
Download Interloper for Windows Installer versionNo account, no installation, nothing changed on your PC. Scanning is strictly read-only; fixes happen only when you click them, and every one can be undone.
Double-click Interloper.exe, click Yes on the Windows prompt (it needs administrator rights to see what malware hides). Choose Run now or Install.
Leave the PC alone for the 15-second behavior sample. The whole sweep takes one to three minutes.
PROTECTED, REVIEW, ATTENTION NEEDED or INTERLOPER DETECTED. Click any finding for why it matters, the evidence, and how to fix it.
Step-by-step instructions written for your make and model - including which key opens your PC's firmware setup - and one-click safe fixes where they are safe, each recorded and reversible.
Known miner programs, look-alike system processes, mining-pool connections and DNS lookups, miners hiding inside Linux on WSL, GPU hogs - with a CPU behavior sample Task Manager cannot fake.
"Proxyware" that sells your internet connection to strangers - Honeygain, Pawns, EarnApp, Grass and dozens more - running, installed as a service, or hiding in autoruns.
Remote-control tools installed as unattended services, internet tunnels, Tor outside Tor Browser, open ports, Remote Desktop without NLA, hidden admin accounts, logons from the internet.
Scheduled tasks, Run keys, Winlogon and IFEO hijacks, startup folders, services, WMI event subscriptions, BITS jobs, COM hijacks, browser-shortcut tampering, planted policies that disable Task Manager or Defender.
Defender real-time state and exclusions, third-party antivirus health, firewall profiles and rules, hosts-file tampering, DNS and proxy hijacks, Secure Boot, memory integrity, rogue root certificates.
Every scan is compared with the previous one: what is new, what changed, what got resolved. A new scheduled task on Tuesday is the kind of thing you want to hear about.
"Secure Boot is OFF" comes with the exact key for your ASUS, MSI, Dell, HP or Lenovo, the menu path, and the save key. No more guessing from forum posts.
With Watch: disable a suspicious task, remove a startup entry, quarantine a dropped file, strip a hijacked shortcut, re-enable Defender, remove a rogue root certificate - logged, reversible, and only when you click. Free users get the same fixes as step-by-step instructions.
A file dropped in Temp and, the same minute, a new driver or service to keep it running: each looks harmless alone. Interloper lines up what changed and when, and tells you when changes arrive together.
The app checks for new versions and fresh detection lists every time it starts. Updates are verified by checksum and publisher signature before they install.
The full scan, every finding and the step-by-step fixes are free, forever, with no account. Watch is for people who want it fixed in one click and watched for them. See a sample report.
That is SmartScreen, and it says it for every new program until enough people have run it. Click More info, then Run anyway. The file is exactly what you downloaded from this page; its checksum is published with every release.
Scanning is read-only - it never kills a process, deletes a file or edits the registry. Fixes happen only when you click Apply safe fix after reading what it will do, and every fix is recorded and can be undone from the Fix history.
No, and you should keep one. Interloper is the second opinion: it looks at behaviour and persistence, the places where miners and backdoors hide from signature-based antivirus, and it tells you what it found in words you can act on. It also checks that your antivirus is actually on.
On the Free plan, nothing. The app downloads a 2 KB version check and the detection lists at start; it uploads nothing. With Watch and "upload reports" on, each report goes to your dashboard - and only there. If you click "Send error details" after a check fails, only the check name, the error message and the app/Windows version are sent. Privacy policy.
Look at a sample report to see exactly what you get. Every build runs several hundred automated tests against the detection rules before it is published, and the app's What it checks page lists every check. Click Self-test in the app to run the detection rules against built-in samples of real miner names, pool addresses and attacker tricks.
Expected. NiceHash, AnyDesk, TeamViewer, Tailscale, game servers, your own hosts-file blocklist - the report says "fine if you set this up yourself" on each. The verdict is about things you cannot place.
Yes - that is what the Technician plan is for. Run Interloper on each customer's PC, type the customer's name once, and every report carries your shop's name, contact line and logo. Your dashboard lists every PC grouped by customer, with history, so the next visit starts with "what changed since last time".
Windows 10 and Windows 11, 64-bit. It needs administrator rights for the full picture (event logs, hidden accounts, drivers); it runs with reduced coverage without them.