Interloper 2.3.1

• The header's account box no longer covers the product name with a long plan line (Technician accounts with a customer set). It shows email, plan and customer; hover it for the full line.
• The known-malware line says plainly when a PC had nothing unsigned or suspicious to check ("no unsigned or suspicious program files to check") instead of "online lookup not used", which read as if the lookup were off.
• Reports from a PC with one-click fixes (Watch, Technician) say so at the bottom and where to find them, instead of the generic "fixes happen only when you click them".
• First update to show the new "Updating Interloper..." window (2.3.0 and later).

Interloper 2.3.0

• You can see an update happening. After Update now, an "Updating Interloper to x.y.z" window stays on screen while the app closes, the new version installs and it starts again. It cannot be closed halfway, and if something goes wrong it says what and where the log is, instead of the app just vanishing. Starting Interloper while an update is still running shows "Interloper is finishing an update and will open by itself" instead of breaking the update. Setup also closes any copy of the app still running from the install folder before it replaces files. (The window appears from the next update after 2.3.0, because the version you are updating from runs the update.)
• Idle-time checks (Watch). Some miners stop the moment you touch the mouse. With Also check while the PC sits idle on (Automatic scans), Interloper runs a 30-second check for miners when you have been away for 10+ minutes, at most once an hour and never on battery. A program without a valid signature using heavy CPU, or a non-Windows program using the GPU hard, while nobody is at the PC is raised to High, written to a report in Idle checks, put on the Desktop as an alert and sent to your dashboard.
• Known-malware fingerprints. Files the scan already finds suspicious (and unsigned files in hideout folders) are fingerprinted (SHA-256) and checked against a known-malware list that arrives with the detection updates. With Watch, the service also looks them up in a public malware database (MalwareBazaar, once the service has its key). A match is Critical, names the malware family, and offers quarantine. Only fingerprints are sent, never files or paths.
• Technician edition ($149/year): everything in Watch for up to 500 PCs, your shop name, contact line and logo on every report, each PC tagged with its customer (Account in the app), and the dashboard grouping and filtering PCs by customer. Branding is set on the dashboard's Account page.
• Safer updates. Downloaded updates wait in a folder only administrators can change (ProgramData) instead of your user profile, so nothing running as you can swap the verified file in the seconds before it runs elevated; PowerShell is always started by its full Windows path; a silent install that fails reports back instead of waiting on a hidden message; and if the update helper cannot start, the app stays open and says so.
• Interloper no longer mistakes its own files, scheduled tasks and command lines for something to report, wherever it is installed or run from.
• Service: /api/reputation (MalwareBazaar lookups with a 30-day cache; off until MALWAREBAZAAR_AUTH_KEY is set), /api/brand, customer per device, Technician prices (STRIPE_PRICE_TECH_YEARLY / STRIPE_PRICE_TECH_MONTHLY), health shows whether lookups are on; website: Technician plan and FAQ, privacy policy covers fingerprints and branding.

Interloper 2.2.3

• Changes made at the same time. New check: a 14-day timeline of services and drivers installed, scheduled tasks created, startup items added and new executables/scripts in Temp and hideout roots. A driver/service/task/startup change arriving within ten minutes of a new unsigned file is flagged (Medium; High when the new service or task runs that file), with the whole burst as evidence and steps to check it.
• Every kernel driver, running or not. New check in every scan (not only Deep): drivers registered from hideout folders or without a valid signature (High; Critical while running), signed drivers registered from unusual folders such as a game folder on another drive (Low, with how to check the signer and remove it), and an inventory of drivers under Program Files.
• Free plan stays on the PC. Free users upload nothing (the app skips it; the service refuses it), so they cost nothing to run. One-click "Apply safe fix" is part of Watch; everyone keeps the step-by-step instructions and Undo. Reports stored during a trial or subscription are kept 30 days after it ends, then deleted.
• Watch adds a weekly summary email (Mondays; opt-out in the dashboard) and plans read "(lifetime)" for very long admin grants.
• Self-test button: runs 29 built-in samples (real miners, pools, attacker tricks, unsafe drivers, and clean controls) through the detection rules.
• Send error details button when a check fails: sends only check name, error message (user/computer names and e-mail addresses removed) and versions. They appear in the dashboard's Admin panel.
• A failed check now says to run the scan again and send error details, instead of only "run as administrator". The RED verdict gives direct advice instead of pointing at README.md.
• Service: report HTML stored gzip-compressed; /api/diagnostics; weekly summaries; automatic purge of reports for accounts without cloud history; website: sample report page, updated plans, privacy policy and FAQ; the site's inline script moved to site.js so the strict security policy no longer blocks it.

Interloper 2.2.2

• Fixed: "Update now" failed with Cannot convert value "download" to type "System.Int32" in 2.2.0 and 2.2.1. The download-progress callback picked up the wrong variable; it is now bound explicitly and a test runs the whole download-and-verify path. (Copies on 2.2.0/2.2.1 need this one version installed by hand; from 2.2.2 on, Update now works.)
• Updates work for a portable copy whatever its file name (a browser saves a second download as "Interloper (1).exe"; 2.2.1 called that a source copy and would not update it).
• Release notes keep their dashes and arrows (the build read CHANGELOG.md in the wrong encoding and wrote latest.json as ASCII, so they showed as "???").

Interloper 2.2.1

• Fixed: in 2.2.0 the checks that verify digital signatures did not run — scheduled tasks, registry autoruns, services, recently added executables, open ports/remote-access tools, kernel drivers and the NVIDIA GPU check showed "Check could not complete … [System.String] does not contain a method named 'ContainsKey'". The code that loads the live signature list reused the name of the signature-check cache and replaced it. Everything checks again; a regression test covers it.
• With the Watch plan active, the status line under the results says automatic scans are included and how to turn them on (instead of offering the trial).
• Fixed: uploading a report to your account could use all of the PC's memory and never finish. Windows PowerShell 5.1 attaches hidden file information to text read from disk, and its JSON converter packed that in too, growing without limit. Everything the app sends to its service now goes through its own JSON writer, which only writes plain data.
• Results show right away. The upload runs in the background after the scan; the verdict line says Uploading…, then Synced to your account or why it was not synced. A slow or broken connection never holds up a scan.
• Uploads are compressed (gzip, about a tenth of the size) and have firm time limits on connecting, sending and the answer, with plain messages ("Could not reach the account service…", "did not answer in time…"). The report always stays on the PC.
• Scheduled scans write the Desktop alert before uploading.
• Service: stores reports that contain NUL characters (from registry data), accepts uploads up to 16 MB after decompression, start-up message lists which database variables it can see, npm run local, and the tests can run against a real PostgreSQL (TEST_DATABASE_URL).

Interloper 2.2.0

• Fix it, for every finding. Each finding now carries step-by-step instructions in plain English. Firmware steps are written for this PC: the engine reads the make, model, board, BIOS vendor, firmware mode (UEFI/legacy), system-disk style (GPT/MBR) and Secure Boot state, and "Secure Boot is OFF" tells you the exact key to tap (Del on an ASUS desktop, F2 on a Dell, F10 on HP, F1/F2 on Lenovo, Volume-Up on a Surface…), the Settings route into UEFI, the menu path for that vendor, the save key, and the extra MBR→GPT step when the disk needs it.
• One-click safe fixes with undo. Where a fix can be done safely from Windows, the Fix panel offers Apply safe fix: disable a scheduled task, remove a startup entry, restore Winlogon/IFEO/policy values, quarantine a dropped file or startup item, strip injected arguments from a browser shortcut, stop and disable a service, stop a miner process, remove a WMI consumer (backed up first), remove Defender exclusions, turn Defender real-time/behavior/script/cloud protection back on, remove planted Defender policies, turn UAC back on, turn off test-signing, disable SMBv1, re-enable core services, turn on memory integrity, disable Remote Registry, remove rogue root certificates (exported first), disable hidden/Guest/Administrator accounts and remove login-screen hiding, turn Remote Desktop off or require NLA, reset DNS to automatic, turn off proxies and PAC scripts, remove port-forwarding rules, disable suspicious firewall rules, turn firewall profiles on, stop over-shared folders, remove hosts-file lines that block security sites. Every fix is confirmed first, logged under Fix history, and reversible with one click. Scanning stays read-only.
• What changed since last scan. Each scan is compared with the previous one: NEW and CHANGED findings are tagged in the list (new CHANGE column, "New since last scan" filter) and in every report, resolved items are listed, and inventory growth (a new program, a new service) is called out. Scheduled scans now alert on anything new at Medium or above, not only on RED/ORANGE.
• Live detection lists. signatures.json is published with every release and refreshed at every start; new miner/proxyware/remote-tool names go out without a new app version (Publish.cmd -SignaturesOnly). Reports show the signature version.
• Accounts and the web dashboard. Account in the header: create a free account or sign in; each report is uploaded (opt-out) to a dashboard that shows every PC, its verdict history and the full report. Scheduled scans, email alerts and "PC has gone quiet" alerts are the Watch plan ($29/year or $3.99/month, 14-day free trial). Stripe checkout and customer portal from the app and the dashboard. Nothing leaves a PC that is not signed in.
• Automatic scans can now run every day as well as weekly.
• Detail pane is structured (title, severity and category chips, WHY IT MATTERS, EVIDENCE) with Fix it… and Copy finding; the shield shows a check mark when protected and an exclamation mark when something needs attention; the list and detail pane share space proportionally and the window sizes itself to the screen.
• Hardware summary (make, model, firmware) in the System summary and the report header.
• Service: server\ (Node/Express/Postgres, tests included, Railway-ready); website: website\ (product page, privacy policy, terms, support).