Is someone mining crypto on your PC? Find out in two minutes.
Interloper runs 20+ read-only checks a technician would take an hour to do by hand: miners, bandwidth-selling proxyware, remote-control backdoors, hidden accounts, and every trick malware uses to survive a reboot. You get one verdict in plain English, with step-by-step fixes written for your PC.
Version , released .
Free to scan. Windows 10 and 11. Under 1 MB, and it runs straight from your Downloads folder. What Windows shows the first time.
How it works
No account, no installation, nothing changed on your PC. Scanning is strictly read-only; fixes happen only when you click them, and every one can be undone.
Download and run
Double-click Interloper.exe and click Yes on the Windows prompt (it needs administrator rights to see what malware hides). Choose Run now or Install.
Click Initiate scan
Leave the PC alone for the 15-second behavior sample. The whole sweep takes one to three minutes.
Read the verdict
PROTECTED, REVIEW, ATTENTION NEEDED or INTERLOPER DETECTED. Click any finding for why it matters, the evidence, and how to fix it.
Fix it
Step-by-step instructions written for your make and model, including which key opens your PC's firmware setup, and one-click safe fixes where they are safe, each recorded and reversible.
What it catches
Cryptominers
Known miner programs, look-alike system processes, mining-pool connections and DNS lookups, miners hiding inside Linux on WSL, GPU hogs, with a CPU behavior sample Task Manager cannot fake.
Bandwidth thieves
"Proxyware" that sells your internet connection to strangers: Honeygain, Pawns, EarnApp, Grass and dozens more, whether running, installed as a service, or hiding in autoruns.
Backdoors and remote access
Remote-control tools installed as unattended services, internet tunnels, Tor outside Tor Browser, open ports, Remote Desktop without NLA, hidden admin accounts, logons from the internet.
Persistence tricks
Scheduled tasks, Run keys, Winlogon and IFEO hijacks, startup folders, services, WMI event subscriptions, BITS jobs, COM hijacks, browser-shortcut tampering, planted policies that disable Task Manager or Defender.
Your defenses
Defender real-time state and exclusions, third-party antivirus health, firewall profiles and rules, hosts-file tampering, DNS and proxy hijacks, Secure Boot, memory integrity, rogue root certificates.
What changed
Every scan is compared with the previous one: what is new, what changed, what got resolved. A new scheduled task on Tuesday is the kind of thing you want to hear about.
Hardware-aware fixes
"Secure Boot is OFF" comes with the exact key for your ASUS, MSI, Dell, HP or Lenovo, the menu path, and the save key. No more guessing from forum posts.
One-click safe fixes with undo
With Watch: disable a suspicious task, remove a startup entry, quarantine a dropped file, strip a hijacked shortcut, re-enable Defender, remove a rogue root certificate. Logged, reversible, and only when you click. Free users get the same fixes as step-by-step instructions.
Connects the dots
A file dropped in Temp and, the same minute, a new driver or service to keep it running: each looks harmless alone. Interloper lines up what changed and when, and tells you when changes arrive together.
Always current
The app checks for new versions and fresh detection lists every time it starts. Updates are verified by checksum before they install.
Plans
The full scan, every finding and the step-by-step fixes are free, forever, with no account. Watch is for people who want it fixed in one click and watched for them. See a sample report.
Free
- Unlimited manual scans
- Every finding explained, with step-by-step fix instructions written for your PC
- What changed since the last scan, and changes that arrived together
- Live detection-list updates
- Reports stay on your PC: nothing is uploaded, no account needed
Watch
- Everything in Free
- One-click safe fixes, each one logged and undoable
- Automatic daily or weekly scans, even when nobody is logged in
- Desktop and email alerts the moment something changes
- A weekly summary email for all your PCs
- Cloud history (100 reports per PC) and every PC in the house or the shop on one dashboard (up to 25)
- Idle-time checks that catch miners which hide while you use the PC
- "PC has gone quiet" alerts
No card needed for the trial. Cancel any time.
Technician
- Everything in Watch
- Your shop name, contact line and logo on every report you hand a customer
- Each PC tagged with its customer; the dashboard groups and filters PCs by customer
- Up to 500 PCs on one dashboard
Create an account, then choose Technician on the dashboard's Account page.
Questions
Windows says "Windows protected your PC" when I run it.
That is SmartScreen, and it says it for every new program until enough people have run it. Click More info, then Run anyway. The file is exactly what you downloaded from this site; its checksum is listed on the download page.
Does it change anything on my PC?
Scanning is read-only: it never kills a process, deletes a file or edits the registry. Fixes happen only when you click Apply safe fix after reading what it will do, and every fix is recorded and can be undone from the Fix history.
Is it an antivirus?
No, and you should keep one. Interloper is the second opinion: it looks at behavior and persistence, the places where miners and backdoors hide from signature-based antivirus, and it tells you what it found in words you can act on. It also checks that your antivirus is actually on.
What leaves my PC?
On the Free plan, nothing. The app downloads a 2 KB version check and the detection lists at start; it uploads nothing. With Watch and "upload reports" on, each report goes to your dashboard, and only there. If you click "Send error details" after a check fails, only the check name, the error message and the app and Windows versions are sent. Read the privacy policy.
How do I know it actually works?
Look at a sample report to see exactly what you get. Every build runs several hundred automated tests against the detection rules before it is published, and the app's What it checks page lists every check. Click Self-test in the app to run the detection rules against built-in samples of real miner names, pool addresses and attacker tricks.
It flagged something I installed myself.
Expected. NiceHash, AnyDesk, TeamViewer, Tailscale, game servers, your own hosts-file blocklist: the report says "fine if you set this up yourself" on each. The verdict is about things you cannot place.
I fix PCs for a living. Can I use it on customers' machines?
Yes, that is what the Technician plan is for. Run Interloper on each customer's PC, type the customer's name once, and every report carries your shop's name, contact line and logo. Your dashboard lists every PC grouped by customer, with history, so the next visit starts with "what changed since last time".
Which Windows versions?
Windows 10 and Windows 11, 64-bit. It needs administrator rights for the full picture (event logs, hidden accounts, drivers); it runs with reduced coverage without them.