SAMPLE REPORT - invented PC and findings, made with the real report engine to show what a scan of an infected PC looks like. Back to the Interloper page

INTERLOPERFind out who else is using your PC.

HOST SAMPLE-PC  ·  2026-11-02 11:36:35  ·  MODE DEEP  ·  DURATION 71s  ·  ENGINE 2.3.0  ·  SIGNATURES 2026.11.01  ·  READ-ONLY SCAN
HARDWARE ASUS desktop (B550 board) - American Megatrends Inc. firmware 3002, UEFI mode, system disk GPT, Secure Boot OFF
RED
INTERLOPER DETECTED

Strong signs of a cryptominer or malware. Start with the Critical findings: each one says why it matters and how to fix it. Disconnect from the internet if you can, and do not type passwords on this PC until it is clean.

3 Critical2 High1 Medium1 Low4 Info

What changed since the previous scan

Since Mon Oct 26, 11:37 AM: 6 new.

  • NEW[Critical] Network: Connection to a mining pool: pool.supportxmr.com:3333 (svchost32)
  • NEW[Critical] Processes: Known cryptominer process is running: svchost32 (PID 7412, 94% CPU)
  • NEW[Critical] Recent Files: Known malware file: svchost32.exe (CoinMiner)
  • NEW[High] Recent Changes: Several changes at the same time on Oct 31 at 9:14 PM: a scheduled task was created, and 2 unsigned file(s) appeared
  • NEW[High] Scheduled Tasks: Suspicious scheduled task: \WindowsUpdateHelper
  • NEW[Medium] Antivirus: Defender exclusion for a folder: C:\Users\alex\AppData\Local\Temp\wuhelp

Critical 3 · Strong evidence of a miner, a backdoor, or malware. Act on these.

ProcessesKnown cryptominer process is running: svchost32 (PID 7412, 94% CPU)NEW
Its name and command line match XMRig, the most common Monero miner, and it is using almost all of the CPU. Your electricity, your hardware wear, someone else's money.
Path: C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe
Command: svchost32.exe -o stratum+tcp://pool.supportxmr.com:3333 -u 4AdUndXH...
Signature: NotSigned
How to fix
  1. Note the file path under EVIDENCE - that folder is the miner's home and you will delete it in a moment.
  2. Stop it: click "Apply safe fix" (or Task Manager > Details > right-click the process > End task).
  3. Find out how it restarts: look at the Scheduled Tasks, Autoruns, Services and WMI findings in this report and fix those too - otherwise it is back after the next reboot.
  4. Delete the miner's folder from the path noted above (if Windows says the file is in use, reboot first, then delete).
  5. If it arrived with a "cracked" game or download, remove that program as well.
  6. If you installed a miner on purpose (NiceHash, Kryptex...), this finding is expected and you can ignore it.
One-click safe fix available in the Interloper app: Stop the process svchost32 (PID 7412) now
Recent FilesKnown malware file: svchost32.exe (CoinMiner)NEW
This file's fingerprint matches a known malicious sample (MalwareBazaar). It is not a guess from its name or location: this exact file has been seen and identified before.
Path: C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe
SHA-256: 5f3c1a9e0b7d4c2e8a6f1b3d9c7e5a2f4b8d6c0e1a3f5b7d9c2e4a6f8b0d1c3e
How to fix
  1. Click "Apply safe fix" to quarantine the file so it cannot run (Undo restores it).
  2. If it was something you downloaded on purpose, move it to a normal folder (Downloads, Documents) instead.
  3. Check Scheduled Tasks / Autoruns for anything that referenced this file.
One-click safe fix available in the Interloper app: Move svchost32.exe into quarantine so it cannot run (it can be put back)
NetworkConnection to a mining pool: pool.supportxmr.com:3333 (svchost32)NEW
This PC is talking to a cryptocurrency mining pool right now.
svchost32.exe (PID 7412) -> 141.94.96.144:3333 (pool.supportxmr.com)
How to fix
  1. Identify the process by its PID in Task Manager > Details and open its file location.
  2. If it is not a program you use, stop it, uninstall it (Settings > Apps) and fix any persistence findings in this report.

High 2 · Needs a human decision. Legit-but-unusual software lands here too.

Scheduled TasksSuspicious scheduled task: \WindowsUpdateHelperNEW
Runs a program from a Temp folder every time you log on, under a name made to look like Windows. Windows Update does not use tasks like this.
Action: C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe
Trigger: At log on
How to fix
  1. Click "Apply safe fix" to disable the task now (it can be re-enabled with Undo).
  2. Open Task Scheduler (search the Start menu), find the task under the path in the title, read its Actions tab, then delete the task once you are sure.
  3. Delete the program the task runs (the path under EVIDENCE) and check Autoruns / Services for other entries that start the same file.
One-click safe fix available in the Interloper app: Disable the scheduled task \WindowsUpdateHelper
Recent ChangesSeveral changes at the same time on Oct 31 at 9:14 PM: a scheduled task was created, and 2 unsigned file(s) appearedNEW
Within a few minutes a scheduled task was created and new unsigned file(s) appeared in Temp or another folder malware uses. Installers can do this, so it is not proof - but it is the pattern of a program that was dropped and set up to keep running. The new service/driver/task points straight at the new file.
2026-10-31 21:14  scheduled task created  \WindowsUpdateHelper  ->  C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe  [NotSigned]
2026-10-31 21:14  new file                svchost32.exe  (C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe)  [NotSigned]
2026-10-31 21:14  new file                cfg.dll  (C:\Users\alex\AppData\Local\Temp\cfg.dll)  [NotSigned]
How to fix
  1. Read the lines under EVIDENCE: they are everything that changed in those few minutes. Did you install something at that time? If so, and it came from the maker's own site or a store, this is that installer.
  2. For each unsigned file: right-click > Properties > Digital Signatures (none = unsigned), or upload it to virustotal.com for a second opinion. Files in Temp are safe to delete.
  3. For the driver / service / task: look it up in the Drivers, Services or Scheduled Tasks findings. If it belongs to something from an unofficial download, uninstall that program, remove the service (sc delete "<name>" in an admin Command Prompt) and restart.
  4. Finish with a full antivirus scan.

Medium 1 · Worth reviewing. Usually a setting to tidy or a program to confirm.

AntivirusDefender exclusion for a folder: C:\Users\alex\AppData\Local\Temp\wuhelpNEW
Windows Defender has been told not to look in the folder the miner runs from. Malware adds exclusions like this to protect itself.
ExclusionPath: C:\Users\alex\AppData\Local\Temp\wuhelp
How to fix
  1. If YOU added this exclusion for a program you trust, ignore it.
  2. Otherwise click "Apply safe fix" to remove it (Undo re-adds it), then run a full Defender scan - whatever was hiding in that exclusion is now visible.
One-click safe fix available in the Interloper app: Remove this Defender exclusion

Low 1 · For your information. Rarely a problem on its own.

Security PostureSecure Boot is OFF
Secure Boot stops bootkits - malware that loads before Windows does. It is switched on in your PC's firmware (UEFI) setup; the fix steps below are written for this PC's make and model.
How to fix
  1. This PC: ASUS desktop (B550 board) - American Megatrends Inc. firmware 3002, UEFI mode, system disk GPT, Secure Boot OFF.
  2. Save your work and close everything. The easy way in: Settings > System > Recovery > Advanced startup > Restart now, then Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
  3. The keyboard way in: restart the PC and tap Del repeatedly as soon as the screen lights up (before the Windows logo). If that does not work, try F2.
  4. You are now in the ASUS setup screen:
  5. If you land in EZ Mode, press F7 for Advanced Mode.
  6. Go to the Boot tab > CSM (Compatibility Support Module) and set "Launch CSM" to Disabled (Secure Boot cannot run with CSM on). If the item is greyed out it is already off.
  7. Back on the Boot tab open Secure Boot. Set "OS Type" to "Windows UEFI mode".
  8. If "Secure Boot state" still says Disabled, open Key Management and choose "Install Default Secure Boot keys" (or "Restore Factory Keys").
  9. Press F10 to save and exit. The PC restarts into Windows as normal.
  10. Run Interloper again: the Security Posture line should now read "Secure Boot: True" and this finding disappears.
  11. If Windows does not start afterwards (rare, only when the boot mode was changed): go back into setup and undo the last change - nothing is lost.

Info 4 · Inventory of what is on this PC, so you can spot anything you cannot place.

Show the 4 inventory items
Recent ChangesChanges in the last 14 days: services, drivers, tasks, startup items and unsigned new files (3)
Newest first. Use it to answer "what changed, and when?" - for example right after you installed something.
2026-10-31 21:14  new file                cfg.dll  (C:\Users\alex\AppData\Local\Temp\cfg.dll)  [NotSigned]
2026-10-31 21:14  new file                svchost32.exe  (C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe)  [NotSigned]
2026-10-31 21:14  scheduled task created  \WindowsUpdateHelper  ->  C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe  [NotSigned]
ProcessesTop CPU consumers during the 15-second sample (machine total ~41%)
37.6% svchost32 (PID 7412) C:\Users\alex\AppData\Local\Temp\wuhelp\svchost32.exe
1.2% msedge (PID 5120) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
0.6% dwm (PID 1180) C:\WINDOWS\system32\dwm.exe
Remote DesktopRemote Desktop (RDP) is disabled
FirewallWindows Firewall is on for all profiles
Scanning is read-only: nothing on this system was modified by this scan. Fixes happen only when you click them in the app, and every one is recorded and reversible.
Plain-text copy: C:\Users\alex\Documents\Interloper Reports\Interloper-sample.txt
(c) 2026 Northkeep Software. All rights reserved.