Features
Catch the cheaters.
Not legit players.
AACGUARD is a forensic scanner for CS2, CS:GO and CS 1.6 community servers. It looks for real cheat traces, weighs the evidence fairly, and gives admins a clear verdict they can explain to their players.
- Running processes
- Loaded modules
- Execution history
- Files & traces
- Autostart entries
- USB history
- Game configs
- Browser traces
in ~17 seconds
Client scan engine
What the scanner looks at
Scans only run when the player presses Start or Restart. Nothing is scanned silently in the background. Each scan checks 22 evidence sources, grouped here into eight areas. Hover a card to see what it means.
Processes & modules
Running processes and loaded DLLs are checked for known cheats and loaders, including 32-bit processes and manually mapped code that tries to hide from normal module lists.
Execution history
Windows keeps records of what ran: Prefetch, BAM, MUICache, AmCache and ShimCache. A cheat that was deleted still leaves a trace here.
Files & traces
Game folders, AppData, Downloads, Desktop and the Recycle Bin are checked for known cheat files and leftovers.
Autostart entries
Run keys and other autostart locations where loaders like to install themselves.
USB history
Traces of external drives, a common way to bring a cheat onto a PC and remove it afterwards.
Game configs
CS2, CS:GO and Steam configs that differ from default, including autoexec.cfg.
Browser traces
Visits to known cheat sites and cheat-related searches, used only as an extra signal next to stronger evidence.
Virtualization
Signs of virtual machines and sandboxes that are used to hide cheats or fake a clean scan.
Cheat-focused
Looks for loaders, injected modules and cheat traces, not overlays, music players or Discord.
Steam-linked
Every scan is tied to a SteamID, Steam name and a clear verdict, so decisions map to real accounts.
Drop-in
Works next to your existing servers and plugins. No special host and no migration of your stack.
Accuracy
Fair verdicts, not guesswork
One suspicious file shouldn't ruin a legit player's reputation. Every finding has a weight, and the verdict looks at both the total score and how many separate detections were found.
- Three verdicts: CLEAN, SUSPICIOUS or CHEAT DETECTED, always with a numeric score.
- Three-stage trust model: findings are re-checked before they count, so legitimate software doesn't push a player over the line.
- Humans decide: admins see all the evidence behind a verdict before they act.
Real case from the technical report
A clean player's score, before and after the trust model
The wrong verdict was corrected automatically, before anyone was banned.
Server attribution
Every scan knows which server it's for
AACGUARD recognizes six games automatically and works out which server the player is connected to by observing the game's network traffic and checking DNS. The result lands with the right server's admins, without the player typing anything.
Data & web panel
Evidence you can show your players
The panel helps admins explain decisions, track repeat offenders, and show players that bans are based on something real.
Masked IPs
IPs are only stored in masked form, for example 2*.42*.**.2*.
Public data wall
An optional public list of scanned and detected players with their verdicts, for full transparency.
Live stats
Total scans, unique players, flags and detections in the last 24 hours, always up to date.
Long-term history
Scans are kept, so admins can spot patterns across weeks and months, not just one scan.
Tech & roadmap
Built for today, aiming further
How it's built
- User-mode Windows clientRuns like a normal app, designed to be safe next to VAC.
- Web panelPHP + MariaDB on a VPS in Germany, connected to the client over HTTPS.
- Edge & analyticsCloudflare for protection, analytics for traffic.
- Updatable detectionsDetection lists are downloaded at scan time, so new cheats are covered without reinstalling.
What's next
- Today22 evidence sources, trust model, server attribution, web panel.
- More artifactsNew evidence sources and faster detection updates.
- Server plugins & APIsDirect integration with game servers and community tools.
- Deeper checksExploring deeper, kernel-assisted checks where possible. Today's client stays fully user-mode.
Tutorial
See it in action in a few minutes
Download, install, run your first scan and learn how to read CLEAN, SUSPICIOUS and CHEAT DETECTED results.
Tip: open the video on a second screen while you run the client.
Every feature is documented.
How detection, scoring and attribution work is published in our technical report, and every release can be verified.