If you downloaded CPU-Z, HWMonitor, HWMonitor Pro, or PerfMonitor from cpuid.com during the April 9-10, 2026 compromise window, treat that download as suspicious until you check the exact file, folder, and account exposure. The original signed CPUID files were reportedly not modified, but the site briefly showed malicious download links that could deliver a legitimate-looking utility together with a malicious CRYPTBASE.dll loader.
This guide is for home users and PC builders who installed, updated, or almost installed CPU-Z or HWMonitor around that incident and now need practical cleanup steps instead of another news recap.
What happened to the CPUID downloads?
Researchers reported that the CPUID website was compromised and that download URLs for CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor were replaced with links to malicious files. Securelist observed the longer window from about April 9, 15:00 UTC to April 10, 10:00 UTC, while CPUID’s public statement to security press described a shorter roughly six-hour side-API compromise and said the original signed files were not affected [1] [2].
The important user-facing point is simple: the danger was the download path, not ordinary CPU temperature monitoring. If your browser, updater, or download history shows a strange installer from that window, check it before trusting the system.
| Reportedly affected tool | Version or file family to check | Why it matters |
|---|---|---|
| CPU-Z | CPU-Z 2.19 / cpuz_x64.exe |
Trojanized packages could pair the legitimate executable with a malicious DLL. |
| HWMonitor | HWMonitor 1.63 / HWMonitor_x64.exe |
Some users saw unexpected names such as HWiNFO_Monitor_Setup.exe. |
| HWMonitor Pro | HWMonitor Pro 1.57 | Included in the reported affected CPUID tool list. |
| PerfMonitor 2 | PerfMonitor 2.04 | Also listed among the affected CPUID downloads. |
How to tell whether you were exposed
Start with the timeline. If you downloaded after CPUID fixed the site and you used a normal CPUID download page, the risk is lower. If the download happened on April 9 or April 10, 2026, check the file and behavior more carefully.
- Open your browser downloads list and look for CPU-Z, HWMonitor, HWMonitor Pro, PerfMonitor, or
HWiNFO_Monitor_Setup.exearound April 9-10. - Check whether the installer came from a CPUID page but redirected to a non-CPUID host, a Cloudflare R2 bucket, or an unfamiliar domain.
- Look in the extracted or installed folder for
CRYPTBASE.dllsitting next tocpuz_x64.exe,HWMonitor_x64.exe, or another CPUID executable. - Treat a Russian-language installer, a mismatched filename, or a security-tool alert during the download as a strong warning sign.
- If you only downloaded the file and never opened it, delete it and scan the system anyway. If you ran it, continue with the deeper cleanup steps below.
Cleanup steps if you ran the installer
- Disconnect from sensitive accounts first. Close browsers, password managers, crypto wallets, FTP clients, and remote-access tools until the machine is checked.
- Remove the suspicious package. Uninstall the CPUID tool from Apps & Features if it was installed, then delete the downloaded archive or installer from Downloads, Desktop, and any build/utility folders.
- Search for the sideloading clue. Use File Explorer search for
CRYPTBASE.dll. The normal Windows copy belongs underC:\Windows\System32orC:\Windows\SysWOW64; a copy next to a downloaded CPU-Z or HWMonitor executable is suspicious. - Check startup persistence. Review Task Manager startup apps, Task Scheduler,
shell:startup, and recently created services for unfamiliar entries created after the download time. - Run a full malware scan. Use your installed security tool, then run a second-opinion scan with Gridinsoft Anti-Malware to check loaders, staged payloads, and leftover persistence that a quick browser-download warning may not cover.
- Rotate exposed credentials from a clean device. If you ran the suspicious installer, change browser-saved passwords, email passwords, game/store accounts, crypto-wallet credentials where applicable, FTP credentials, and any admin or remote-access passwords. Revoke old sessions where the account provider allows it.
- Reinstall only after cleanup. Download CPU-Z or HWMonitor again from the official CPUID pages after the system is clean. As of May 27, 2026, CPUID lists CPU-Z 2.20.1 and HWMonitor 1.63 on its official software pages [3] [4].
After uninstalling the suspicious app or deleting the visible threat, use Gridinsoft Anti-Malware to check hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and other persistence points that can restore malware.
Download Anti-MalwareDo you need to reinstall Windows?
Do not jump straight to a Windows reinstall just because you visited the CPUID website. A reinstall becomes reasonable when you executed the suspicious installer and then find persistence, unexpected remote access, account theft, cryptocurrency-wallet access, or repeated detections after cleanup.
If Defender or another security tool blocked the download before execution, the safer path is to delete the file, run a full scan, review browser/download history, and monitor important accounts. If you bypassed warnings or ran the installer, assume stored browser credentials may be exposed until you rotate them from a clean device.
How Gridinsoft helps in this case
Gridinsoft Anti-Malware is useful here because the problem is not just “is CPU-Z safe?” The practical question is whether a malicious companion file, loader, scheduled task, or staged payload remained after a poisoned download. Run a full scan after removing the suspicious installer, then review detections by path and creation time so you can separate normal CPUID files from files that arrived through the compromised download flow.
FAQ
Is CPU-Z malware now?
No. CPU-Z itself is a legitimate CPUID system information tool. The reported incident involved malicious download links shown by the CPUID website during a short compromise window, not a permanent change that makes every CPU-Z copy malicious.
Is HWMonitor safe to download now?
CPUID and security reporting say the compromise was fixed. Download only from the official CPUID page, avoid mirrored installers, and scan any file if the filename, language, or source host looks wrong.
What is CRYPTBASE.dll in this incident?
Researchers reported a malicious file named CRYPTBASE.dll bundled beside legitimate CPUID executables. That location matters: Windows has legitimate CRYPTBASE libraries in Windows system folders, but a copy next to a downloaded CPU-Z or HWMonitor executable is a red flag.
I downloaded the file but did not run it. Am I infected?
Usually not, but delete the installer or archive and run a scan. The higher-risk scenario is executing the trojanized package, because that can load the malicious DLL and fetch or run additional payloads.
Related cleanup: if the suspicious download involves a legitimate-looking executable loading an unexpected DLL, use our nethost.dll and ProtonVPN.exe malware cleanup guide to check side-loading, persistence, and account recovery steps.
References
- Securelist Threat Response. “CPU-Z / HWMonitor watering hole infection – a copy-pasted attack.” Securelist, posted April 10, 2026, updated April 16, 2026, accessed May 27, 2026. https://securelist.com/tr/cpu-z/119365/
- Eduard Kovacs. “CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads.” SecurityWeek, April 13, 2026, accessed May 27, 2026. https://www.securityweek.com/cpuid-hacked-to-serve-trojanized-cpu-z-and-hwmonitor-downloads/
- CPUID. “CPU-Z.” CPUID official software page, accessed May 27, 2026. https://www.cpuid.com/softwares/cpu-z.html
- CPUID. “HWMonitor.” CPUID official software page, accessed May 27, 2026. https://www.cpuid.com/softwares/hwmonitor.html
