Every update,
in the open.

Version 0.0.15 is the biggest detection update so far. A cheat no longer gets past AACGUARD just by being renamed: programs are checked for what is inside them, Windows' own memory is read for programs that ran since the PC started, and a program that is talking to a cheat server is caught while it runs, in the full scan and in AACGuard Live. CS 1.6 game files are compared with Valve's originals, and Arduino / KMBox / DMA hardware is recognised when it is used on match day.

Results are also easier to understand and fairer: every finding shows when it happened and how many points it counted, there is a "Think this is wrong?" button, macro software no longer counts by itself, and players with several non-Steam CS 1.6 builds are no longer flagged because of the protectors those builds ship with. And the full scan now runs about twice as fast, with a real progress bar.

• New: renamed cheats are found by what is inside them – Unsigned programs in Downloads, Desktop, Documents, Temp and AppData, programs that are running, and programs Windows recorded as run are read for the names a CS cheat needs: CS2 / CS:GO memory offsets and player fields, and the CS 1.6 client functions cheats hook. Calling a cheat discord_update.exe no longer hides it. Only the matching names and the path are reported, never the file.
• New: connections to cheat servers – Paid cheats and loaders stay connected to their license server while they run. AACGUARD now checks which program is connected to a known cheat server, using the addresses your PC itself looked up, in the full scan and every AACGuard Live check. No traffic is read.
• New: Windows memory since start-up – Explorer and the Windows services PcaSvc, DPS, DiagTrack and SysMain keep the paths of programs run since the PC was started, even after the file was deleted, renamed or run from a USB stick. The scan reads those paths; only the ones matching cheat names are reported.
• New: CS 1.6 file check – Wall textures (.wad), player models, smoke sprites and game DLLs of Steam and non-Steam CS 1.6 are compared with Valve's original files, taken from Steam itself. See-through walls, bright models and removed smoke no longer need a running program to be found. Weapon skins and other cosmetic changes are only listed.
• New: hardware cheats – Arduino / Teensy boards set up as a mouse, KMBox, Cronus and XIM adapters, and DMA cards (FPGA boards, FT601 bridges). They only count when connected now or today; older ones are listed for information, because owning an Arduino is not cheating.
• New: UserAssist – Windows' list of programs started from the desktop, Start menu or taskbar, for every user profile, with the last start time. It stays after the program is deleted.
• New: macro scripts judged by what they do – AutoHotkey scripts, Logitech G Hub / LGS Lua scripts and Bloody macros are read. Having macro software never counts anymore (AutoHotkey, AutoIt and TinyTask were removed from the cheat lists); only a script that controls recoil or repeats jumps counts a little, and one that aims or clicks by screen colours counts as a cheat.
• New: cheat files shared on Discord – The Discord app's cache is checked for the names of programs and archives received in chats. On its own it only adds a little, because a file in a chat does not prove it was run.
• New: Steam accounts on this PC – Every Steam account used on the PC is listed (never login names) and checked by the website for VAC, game and AACGUARD bans, so alt accounts of banned players are recognised. The list is only visible to AACGUARD staff; others only see how many linked accounts are banned.
• New: cheat file fingerprints – When a cheat file is still on the PC, its SHA-256 / SHA-1 fingerprint goes into the scan log and the website collects them, so the same cheat is recognised on other PCs even after it is renamed.
• New: dates on every finding – Every finding now shows when it happened on the PC (launched, detected by Defender, deleted, file created...) and how long before the scan, in the app and on the scan page. The times in the raw log are only when the scan ran.
• New: why it counts, and how much – Every finding shows how many points it counted ("Counts 40 points", "Counts 200 of 1000 points", "Information only") with the reason, in the scan report list and on the scan page.
• New: "Think this is wrong?" – A button in the scan report opens the appeal page for an uploaded scan, or explains how to report a single finding as a false positive. The scan page has the same help.
• About twice as fast, with real progress – Independent checks now run side by side (a full scan went from about 30 to about 15 seconds on our test PC), and the progress bar fills up with what is being checked ("Scanning: program history, files and folders (12/46)").
• Fairer verdicts for non-Steam CS 1.6 – Protectors and Steam emulators that non-Steam builds ship as .asi plugins no longer add up to CHEAT DETECTED: without cheat code inside they count once per scan, and files reviewed as legitimate do not count at all. An .asi plugin with cheat code inside is still caught, now with more weight.
• Clock tricks – Clock changes are now also read from the Security log, and when a program moved the clock back, older traces no longer get a lower weight in the verdict.
• Windows Defender – Defender findings now show what Defender really did (for example Quarantine) instead of "Not Applicable", with the time of the detection and of the action.
• Website – Scan pages show the date and the points of every finding with a plain explanation and a "Think a finding is wrong?" box; staff see the other Steam accounts of a PC with their bans; and the cheat fingerprints from scans are collected for review.

Version 0.0.14 makes it much easier to show your scan to a server admin. Every uploaded scan now gets a 6-digit Server owner PIN, and the end of the scan has buttons to copy your scan link or open your scan page. Admins type the PIN in the new Server owner window and see the whole scan right in the app.

Scans are also faster on PCs with a lot of files in AppData, and CS 1.6 players who play on Steam are no longer marked as non-Steam just because a cracked copy is also installed.

• New: Server owner PIN – Every uploaded scan gets a random 6-digit PIN, shown at the end of the scan with a copy button. Give it to a server admin: anyone with the PIN can open that scan in AACGuard for 7 days. Personal details in the log stay hidden, exactly as on the scan page.
• New: Server owner window – A new entry in the left menu. Type a player's PIN and see their whole scan in the app: verdict, score, game and server, the games the cheat traces are for, every finding with its strength and the full scan log, with buttons to copy the link or open the scan page. Only the PIN is sent, nothing about your PC.
• New: Copy link & Open scan page – The report at the end of an uploaded scan now shows your scan page with Copy link and Open scan page buttons, so sending your result to an admin takes one click.
• Much faster AppData check – On PCs with hundreds of thousands of files in AppData, the check used to compare every file with the whole whitelist. Files are now filtered first, so only the few thousand that matter are checked in detail. The results are the same, the scan just finishes sooner.
• Steam or non-Steam CS 1.6 – When CS 1.6 is running, the scan now records which copy it is: Steam's own or a non-Steam (cracked / custom) build, also when a cracked build was copied into the Steam folder. Players on Steam's CS 1.6 no longer see "non-Steam" on their scan page just because another copy is installed; the page shows a STEAM tag instead.
• Website – 25 new guides (several with animated how-tos) and a FAQ, link previews for scans, profiles, servers and guides on Discord and other apps, profile badges, more customisation for server pages, a new phone menu, and people's names and e-mail addresses now hidden in scan logs too.

Version 0.0.13 makes AACGUARD easier to understand and to trust. The app now speaks 8 languages, explains every finding in plain words, lets you report a false positive with one click, keeps your last 10 scans on your PC and tells you when a new version is out.

You can also run a quick pre-match check before a scrim and share the result as a link, and PRO players get three new themes and a stronger Fresh Start. Under the hood, Steam CS installs are found reliably, USB traces produce far fewer false alarms, and times on the website now show in your own time zone.

• New: memory signature scanning – While CS or another Valve game runs, AACGUARD now searches the game's own memory for byte patterns and names of known cheats, so internal cheats are caught even when they are hidden, renamed or loaded without a file. New signatures are added on our side without an app update. AACGuard Live repeats it every few minutes. Nothing read from memory is stored or sent.
• New: OpenGL wallhack detection (CS 1.6) – AACGUARD checks whether the game's OpenGL drawing functions are hooked, which is how CS 1.6 wallhacks draw players through walls, whatever the cheat is called or however it was loaded. Graphics drivers and known overlays and recorders (Steam, Discord, OBS, RivaTuner, NVIDIA, AMD, Fraps, Bandicam and others) are ignored, and only from their real install folders, so a renamed cheat cannot pass as one.
• New: 8 languages – The app is now available in English, Romanian, French, Italian, Russian, Chinese, Japanese and Korean. Pick yours with the new language button at the bottom of the window; the app switches instantly and remembers your choice. English stays the default.
• New: "Why is this flagged?" – Every finding in the scan report now explains in plain words where it was found, why it can mean a cheat, how many points it counted and what you can do about it.
• New: Report false positive – Think a finding is wrong? Press Report false positive in the scan report to send that one finding (with an optional note) for review. Your Windows account name is removed from file paths first. Confirmed mistakes get whitelisted for everyone.
• New: Pre-match check & share link – A 10-30 second check of what is running right now, from the new Pre-match check button. Create a share link to show the result before a scrim or server entry: anyone with the link can see your verdict, game and time for 3 hours. Nothing is uploaded unless you create the link.
• New: Scan history – Your last 10 scans are saved on your PC (never uploaded). Open Scan history in the sidebar to see each verdict and reopen its full report at any time.
• New: Update notice – AACGUARD checks for a new version at start and every few hours and shows an Update button when one is out, instead of only telling you when an upload fails.
• New PRO themes – Three new themes with animated backgrounds: CS 1.6 Classic (the olive in-game look with a live server browser and console), Minecraft and FiveM Los Santos. PRO now has 10 themes in total.
• Fresh Start (PRO) got stronger – It now also removes shortcuts to cheat files, including the ones Windows keeps in Recent after a file is deleted, and can optionally remove the cheat sites and cheat searches a scan found from your browser history (only those entries). Every removal is still recorded and shown in later scans for 30 days.
• All Steam Counter-Strike versions found – The game-folder check now finds CS2, CS:GO Legacy, CS 1.6, Condition Zero and CS: Source through Steam's own install records, whatever the folder is called, and no longer shows an error when CS is not installed.
• Far fewer USB false alarms – AACGUARD itself, programs on external drives that are always connected, and everyday apps such as WinRAR, 7-Zip, installers and signed tools are no longer listed as unknown programs run from USB. Cheat names and known cheat files are still checked on every drive.
• Fewer Half-Life sound plugin false positives – Older Miles sound codecs (.asi) that non-Steam CS 1.6 builds ship with are recognised and no longer counted as cheat plugins.
• Cleaner scan log – USB devices are listed once instead of twice, with all their details in one place.
• Times in your time zone – Scan and ban times on the website are now shown in your own local time (our server stores them in UTC). Hover a time to see the UTC value. The app's Detected players window does the same.
• Data use & consent – The in-app notice and the Privacy Notice now describe false-positive reports, pre-match check links, scan history and the update check.
• Fixed: Detected players window empty – The in-app list of today's scans showed nothing after a website change; it now reads the list again and copes with future layout changes.
• Fixed: version shown in the app – The version badge at the bottom of the window now always shows the real installed version.

Version 0.0.12 turns AACGUARD into an app that is ready whenever you play. It starts with Windows, waits in the system tray running AACGuard Live and, while CS2, CS:GO, CS 1.6 or another Valve game (TF2, Dota 2, Deadlock, Left 4 Dead...) is open, checks what is running with the game every 30 seconds. Everyone running AACGuard shows on the new Live page, marked verified when signed in with Steam.

You can now sign in with Steam inside the app to see your profile and stats, export any scan report as PDF or HTML, and get the optional AACGUARD PRO plan. Fewer false positives, and Windows account names are now hidden everywhere on the scan pages.

• New: AACGuard Live – Starts with AACGuard (and with Windows) and checks running programs, overlays and drivers every minute. While CS2, CS:GO, CS 1.6 or another Valve game (such as Team Fortress 2, Dota 2, Deadlock or Left 4 Dead) is open, it also checks the game every 30 seconds for injected code, programs reading its memory and proxy DLLs. It does not read history. Everyone's status (CLEAN, SUSPICIOUS or CHEAT DETECTED) shows on the new Live page and their profile, marked verified when signed in with Steam in the app. Can be turned off in the tray menu until AACGuard restarts.
• New: Live players window – Everyone running AACGuard Live, in the app: status, game, server and session time, with filters, search and the sessions that ended in the last 2 hours. Opens from the sidebar or the tray menu.
• New: tray app & start with Windows – Closing the window keeps AACGUARD in the system tray, with a menu for status, quick check, full scan, sign-in, Fresh Start, Detected players, AACGuard Live and Start with Windows. It starts with Windows by default; turn it off in the tray menu.
• New: quick check – A few-second check of what is running right now, from the tray menu. It stays on your PC and is not uploaded.
• New: Steam sign-in & profile in the app – Sign in through aacguard.com in your browser and return to the app signed in. The profile shows your Steam avatar and name, FACEIT and Premier stats, and your AACGUARD scan totals, detections and highest score.
• New: export scan reports – Save any scan report as a PDF or HTML page for your records or an appeal. Free for everyone.
• New: AACGUARD PRO – Optional one-time purchase (1 or 12 months, no auto-renew) with a PRO badge, an animated name on public lists and Fresh Start. PRO never changes scan scores. See the PRO page.
• New: Fresh Start (PRO) – Deletes the cheat files a scan finds, only the ones you tick. Blocked while a game is open or you are on a server, never wipes Windows activity records, and later scans show that it was used.
• Fewer false positives – Aim training maps (aim_botz) and Windows Perception system files no longer match cheat names, and name-only guesses can no longer add up to CHEAT DETECTED on their own.
• More privacy on scan pages – Windows account names are now hidden everywhere on the scan pages: in all path formats (including Prefetch volume paths and forward slashes), in account names like DESKTOP-1\***, and anywhere else they appear in the log.
• Sponsor banner – A banner at the bottom of the app shows our sponsors, changing every 5 seconds. Sponsors never see scans or affect results. Want your ad there? Talk to us on Discord.
• Website – FREE / PRO tags on Detected players and scan pages, a fixed Banned players table, and updated Privacy Notice, Terms, EULA, Cookie Policy and GDPR pages describing the new features.

Version 0.0.11 is the biggest update so far. AACGUARD now catches external cheats that never touch the disk by name (memory readers, ESP overlays and CS 1.6 proxy DLLs), reads many more Windows records with reliable timestamps, recognises players returning on new accounts through a one-way hardware fingerprint, and explains every verdict with a local scan report.

Verdicts are also fairer: old traces count less, cheats for another game are shown but not counted, and the whitelist can no longer be abused. The desktop app has been redesigned with a dark blue theme that works at any window size.

• New: game memory access check – While a game is running, AACGUARD lists every other program that has the game's memory open for reading or writing. External ESP and aimbot tools are now caught whatever they are called. Signed Windows, Steam, Discord and antivirus processes are ignored.
• New: ESP overlay detection – Finds invisible, always-on-top, click-through windows drawn over the screen, the way external ESP overlays work. Known overlays (Steam, Discord, NVIDIA, MSI Afterburner and others) are ignored.
• New: CS 1.6 proxy DLL & ASI plugin check – Game folders (Half-Life, CS:GO, CS2, including non-Steam CS 1.6 installs) are checked for fake opengl32.dll, d3d9.dll, dinput8.dll, version.dll and similar files, and for .asi plugins. Genuine Windows copies, the original Half-Life sound plugins and ReShade are not counted.
• New: cheat version labels – Every Counter-Strike finding now shows which game it is for: CS 1.6, CS:GO, CS2 or CS:GO / CS2, based on the cheat name and where it was found.
• New: hardware fingerprint – One-way salted hashes of the motherboard, BIOS, SMBIOS UUID, system disk, Windows machine ID and network adapter are sent with each report, so banned players returning on a new Steam account can be recognised. Raw serial numbers never leave the PC.
• New: HWID spoofer detection – Traces of hardware-serial spoofers in activity records, running programs and drivers, plus wired network adapters using a changed MAC address.
• New: tamper checks – Flags cleared Windows event logs, Prefetch switched off, the clock changed by a program, aacguard.com blocked (hosts file, DNS or firewall) and Windows booted with test-signing or kernel debugging.
• New: Windows Defender history – Cheat detections that Windows Defender recorded (threat name, file and time) are now part of the scan.
• New: deleted files – Recently deleted or renamed files are read from the NTFS change journal, so cheats removed just before a scan still leave a trace.
• New: Windows 11 launch log, DNS cache, services, drivers & scheduled tasks – Programs launched (PCA log), recently visited cheat domains, and cheat services, drivers or tasks registered on the PC are now checked.
• New: USB traces – Lists every USB storage device the PC has seen, with connect and remove times, and links programs, files and folders used from USB sticks or removed drives back to the device.
• New: Explorer history, Recent files & Jump Lists – Folders opened in Explorer (ShellBags), recently used files and Jump Lists are read for every Windows user on the PC, including accounts that are not signed in.
• New: known cheat hashes – Files and AmCache records can be matched against SHA-256 / SHA-1 hash lists from the server, so renamed cheats are still recognised.
• Bigger cheat lists – Around 100 new names: DMA and hardware cheats (pcileech, KMBox, Captain DMA, Cronus Zen, XIM and others), more CS 1.6, CS:GO and CS2 cheats, plus FiveM, Minecraft and Roblox cheats.
• AmCache now works – AmCache is read through a temporary Windows shadow copy when Windows has it locked (thousands of records on a normal PC), including file hashes, publisher and compile date.
• Reliable Prefetch, BAM, ShimCache & MUICache – Prefetch files are fully decoded on Windows 10/11 (program path, drive, last 8 run times and run count), BAM/DAM shows the last run per user, ShimCache supports the Windows 7, 8 and 10/11 formats, and MUICache is read for every user.
• Timestamps everywhere – Every finding now carries an evidence timeline (run, visit, created, modified, deleted, connected times). Browser history matches show the visit count and first / last visit times, which were previously missing.
• Smarter cfg detection – CS 1.6, CS:GO and CS2 cfg files are analysed for real cheat / HvH settings. Only cfgs identified that way are listed or uploaded; normal player cfgs are no longer flagged.
• Fairer verdicts – Traces older than 30 days count less (50% up to 90 days, 20% up to a year, 10% after), cheats for another game are reported but not counted (a Roblox executor on a CS scan), informational findings never count, and each cheat site counts once per browser.
• More precise name matching – Short cheat names (like otc or xeno) only match as whole words, so files like hotcake.exe no longer trigger detections.
• Whitelist can no longer be abused – A cheat placed in a whitelisted folder or given a whitelisted name is still detected in Downloads, Desktop and Temp, and whitelist entries that are too broad are ignored and shown in the log.
• Stricter trusted-signer check – Only files signed by an exact, known publisher are treated as legitimate; look-alike company names are no longer trusted.
• Local scan report – A report window opens after every completed scan (uploaded or not), showing each finding with its location, why it was flagged, how many points it counted and its evidence timeline.
• Updated Data use & consent – The in-app notice now lists every check the scanner performs and exactly what is sent, including the hardware fingerprint.
• Redesigned desktop app – New dark blue glass design with a faint CS 1.6 background, translucent cards and subtle animations even before a scan starts.
• Works at any window size – The layout adapts from small windows to full screen, the window can be resized and maximised without covering the taskbar, and the raw log wraps, can be expanded and copied.
• Detected Players window – The Detected Players button now opens the full list of today's scans inside the app; the detected list still opens on the website.
• Removed: over-broad whitelist entries – Entries that trusted entire user, AppData Local and AppData Roaming folders, and entries tied to specific Windows user names, were removed and replaced with paths that work on every PC.
• Removed: uploading every non-default cfg – Only cfgs with cheat / HvH settings are uploaded now.
• Fixed: scans reporting CLEAN without rules – When the scan rules cannot be downloaded the scan now stops with an error instead of showing CLEAN.
• Fixed: wrong verdicts – Corrected how findings were classified and scored, and server information no longer affects the verdict.
• Fixed: crashes and restarts – Errors inside a single check no longer stop the whole scan, and starting a new scan right after one finished no longer mixes results.
• Fixed: browser timestamps missing – Visit times from Chromium and Firefox browsers are now converted and shown correctly.
• Fixed: AmCache, BAM & Run keys – AmCache no longer fails when locked, BAM entries are read for every user with correct times, and Run key entries are parsed correctly.
• Fixed: USB detection – USB drives reported as fixed disks are now recognised as USB, and anti-cheat files on a USB stick are no longer flagged by loose name matching.
• Fixed: duplicate and garbled findings – The same keyword is no longer counted twice in a cfg, and Explorer folder names are no longer shown as garbled text.
• Fixed: unreadable text & layout – Dark text on dark backgrounds is now white, and the status and top info cards are no longer overly rounded when the window is resized.

Version 0.0.10 focuses on context and accuracy: AACGUARD now knows which game a player is running and which server they are connected to, inspects the game process more deeply, and filters out legitimate software that previously caused false positives, all with a cleaner, easier-to-read desktop interface.

• Automatic game detection – Recognises CS2, CS:GO, CS 1.6, FiveM, Minecraft (Java & Bedrock) and Roblox from running processes, and reports the game at scan start.
• Connected server detection – For CS 1.6, CS:GO and CS2, the scan now identifies the server the player is on and shows its domain (e.g. go.mortall.ro) when available, otherwise its IP:port.
• Last played server – If the player is not connected during the scan, AACGUARD shows the last server they played on, clearly marked as LAST instead of LIVE.
• Deeper module inspection – The game process scan now sees the modules loaded into 32-bit games like CS:GO and CS 1.6, which were previously invisible to the scanner.
• Injected code detection – New check for cheat code loaded directly into Counter-Strike's memory without a file on disk.
• Kernel driver check – Flags drivers commonly used by cheat tools and kernel-level cheat loaders.
• Debugging & memory tool detection – Reports memory editors, debuggers and injectors running during the scan.
• Far fewer false positives – GPU drivers (NVIDIA, AMD, Intel), overlays (Steam, Discord, OBS, Medal, RivaTuner), antivirus software and other trusted, signed components are now recognised as legitimate and no longer affect the score.
• Redesigned desktop app – New layout with a colour-coded verdict card, clear score, detection and check counters, dedicated game and server cards, and per-check status pills.
• Server column on the website – The detected players list and scan pages now show the player's server with LIVE/LAST status and one-click copy.
• Redesigned scan page – Scan reports are easier to read on desktop and mobile, with a plain-language summary and a clear list of every check performed.
• General reliability improvements – Scoring thresholds are unchanged, while server information no longer counts as a detection, keeping verdicts fair and consistent.

Finalized the 0.0.9 release by expanding AACGUARD’s detection and review coverage across browser traces, system artifacts and usage indicators, while improving reliability and keeping the desktop app workflow lightweight for players and administrators.

• ShimCache, MUICache and AmCache support – Added handling for additional forensic artifacts, with ongoing AmCache work still limited by the lack of kernel access for full reliability.
• BAM artifact coverage – Added BAM analysis to improve visibility into execution-related traces.
• More browser support – Added support for additional browsers and browser backups, including browsers downloaded from the Microsoft Store.
• Better virtualization finder – Improved VM detection to help identify cases where cheats may have been run inside virtual machines.
• Improved USB detection – Refined USB artifact handling for clearer device activity review.
• Better Recycle Bin review – Enhanced Recycle Bin parsing with the last deletion time now shown for faster investigation.
• Improved AppData coverage – Expanded AppData handling to surface more useful traces during review.
• General reliability improvements – Continued internal cleanup and workflow refinements to keep scans and review output more useful and consistent.

Finalized the 0.0.8 release by improving AACGUARD’s public website, legal/compliance pages, moderation ecosystem and internal detection workflow, while keeping the core desktop app behaviour unchanged for players and admins.

• Cookies module and consent flow – Added and refined the website cookie consent module to better manage necessary, preference, analytics and marketing choices with clearer user control.
• New Cookies Policy page – Published a dedicated cookies policy covering consent categories, third-party services, analytics usage and how visitors can update their preferences.
• New GDPR policy page – Added a dedicated GDPR notice with controller details, legal bases, data categories, user rights, retention, transfers and Romania-specific supervisory authority information.
• AI-assisted log phrasing – Integrated an AI bot powered by TinyLlama to help phrase, summarize and rapidly interpret raw logs into clearer operational context during review.
• Improved detection quality – Refined internal detection logic and review flow to produce more useful signals and cleaner interpretation without changing the app’s visible workflow.
• Discord server refresh – Updated the Discord server structure and channels to improve communication, support flow, announcements and community organization.
• No client-side usage changes – This release does not change how the AACGUARD desktop app is used by players; the improvements are focused on website, compliance, moderation support and ecosystem quality.
• Host Upgrade – I increased the server plan to one with more resources. Still on ovhcloud.com!

Split AACGUARD into a proper client–server architecture with a new ASP.NET Core API on your Debian host, moved all scan writes from the desktop into a central MySQL backend, and wired the Windows client to submit scans over HTTP so users never touch the database directly while you keep full control and observability on the server.

• Upgraded scan flow – Cleaned up how scans run and finish so every session now produces a consistent status, score and detection count without changing how players use the app.[web:7]
• Richer evidence per scan – Standardized what AACGUARD records (game process, exit state, browser checks, operations JSON and detailed logs) so each scan has clearer, more useful history behind it.[web:7]
• Advanced cheat detection logic – Refined and extended existing detection code to better catch loaders, injected modules and suspicious behaviour patterns while staying focused on cheats instead of harmless background apps.[web:7]
• Secure API-backed saving – Moved all database writes behind a dedicated ASP.NET API, removing direct DB access from the client and making stored scans harder to spoof or tamper with.[web:7]
• More robust error handling – Improved how the app reacts when saves fail or the backend is unreachable, showing clearer messages instead of low-level database errors.[web:7]

Refined the desktop UI with a new footer, legal copy and upgrade controls, added a server-backed self-integrity gate, enforced admin-only startup, and introduced a detailed post-scan summary so every run ends with a clear, auditable report.

• Server‑driven integrity JSON – New IntegrityHelper downloads aac_hash.json, computes the running EXE’s SHA‑256, and only considers the client valid when it matches the hash configured on the AACGUARD backend.
• Integrity‑gated DB writes – SaveScanToDatabase now calls VerifySelfIntegrity() before version checks or inserts, aborting scans with a clear “executable modified or corrupted” message instead of silently proceeding.
• Admin‑only startup gate – The WPF App class checks for elevation on OnStartup and shuts down immediately with guidance if AACGUARD is launched without Administrator rights.
• End‑of‑scan popup report – After a successful transaction commit, the client now shows a detailed MessageBox summarizing player info, final status, total checks, detections, score, and every OperationResult entry.
• Cfg file listing in summary – The new report also lists all captured cfg files per scan and marks userdata configs, making it easier to connect suspicious cfg evidence with concrete file names on the client side.
• Legal-aware footer – The main window now includes a compact footer with inline links to Terms, Privacy Policy and the EULA, keeping legal context visible without cluttering the primary scan surface.
• Quick access links – Dedicated buttons for the AACGUARD website, upgrade/download page and official Discord are exposed directly in the UI, so users can update, read docs or get support without hunting for URLs.

Tightened AmCache/ShimCache, AppData and shortcut heuristics to focus on real cheat loaders and cfg evidence while aggressively suppressing noisy system/runtime artifacts.

• AmCache focus – Amcache scanning now extracts the filename and only flags hits when it matches exact cheat or loader names, ignoring generic paths and benign Java/OpenJDK entries.
• ShimCache focus – ShimCache/AppCompatCache parsing was aligned with AmCache: filenames are matched against the same cheat/injector lists and are skipped entirely if they fall under whitelisted paths.
• AppData hardening – The AppData walker normalizes paths before whitelist checks and adds specific rules for Autodesk Inventor/ODIS temp DLLs, dramatically reducing “Suspicious file in AppData” noise.
• Shortcut sanity – Shortcut scanning now works on the base .lnk name with the central cheat-name matcher instead of raw substrings, so legit apps like Shotcut no longer trigger weak detections.
• Cfg evidence – The cfg inspector reports all matching cheat, search, and HVH keywords per file instead of stopping at the first hit, giving admins a fuller picture of how a config was tuned.
• Scoring hygiene – Internal scoring and whitelist use were refactored so system DLLs, game launchers, Java runtimes and other known-safe components stop inflating scores or flipping scans to CHEAT DETECTED on their own.

Extended the admin panel with deep CS:GO cfg inspection, safer IP masking for screenshots/logs, and a per-user scan history view to make manual triage much faster.

• CFG browser – Scan view now lists all collected CS:GO cfg files split into default and unknown/non-default sets, mirroring the client-side classification.
• Popup viewer – Each cfg entry has a View action that opens a Tailwind-styled modal and shows the stored cfg content directly from the database without leaving the scan page.
• Safe transport – A dedicated cfg_view.php endpoint returns only cfgs that belong to the current scan/user, preventing arbitrary path access and keeping cfg content scoped to legitimate records.
• IP masking – Public IP masking logic was updated to a custom per-octet pattern (e.g. 11.11.11.11 → 1*.*1.11.1*) that is stable for admins but hides enough detail for sharing screenshots/logs externally.
• Consistency – The same masked IP format is now surfaced in the admin scan view, so operators always see exactly what the client reported without exposing the full address.
• User history – The bottom of the scan page now shows a compact table of other scans for the same user (time, status, score, detections, game process), with the current scan highlighted.
• Fast navigation – Each historical entry links back into scan_view.php, making it trivial to hop between suspicious scans for the same account during investigations.
• Admin UX – Layout widths were slightly relaxed and tables made horizontally scrollable so cfg paths and process names remain readable even on narrower screens.

Refined how AACGUARD interacts with Windows forensic artifacts, especially AmCache, to improve robustness on locked systems while keeping detection logic unchanged.

• Improved – AmCache scanner now always works on a temporary copy and never touches the live hive directly, reducing the chance of unnecessary file locking and access conflicts.
• Hardened – Added a dedicated TryReadAmcacheHive helper that uses maximal safe sharing flags and gracefully handles the “file in use by another process” condition instead of crashing the scan.
• Resilient – When AmCache is exclusively locked by the OS, AACGUARD now reports a clear, non-fatal warning and continues the rest of the scan instead of treating it as a hard failure.
• Future-ready – Internals refactored so a Volume Shadow Copy (VSS)-based reader can be plugged in later without changing the detection rules or UI text for AmCache.
• Safety – Confirmed that AmCache access is performed via standard read-only file I/O patterns commonly used by DFIR tools, avoiding invasive kernel tricks that could resemble cheat behavior to third-party anti-cheats.
• Versioning – Added real versioning compatibility!
• Limits – Daily per-user scan cap is enforced more cleanly, with a clear client-side message when the 5 scans/day limit is reached instead of a silent failure.
• UI polish – Admin panel scan view shows masked IP and additional environment details (browsers used, game exit status) for quicker manual triage.

Focused on detection reliability, exact-name matching, and consistent scoring across all forensic modules.

• New – Exact-name scoring system (ExactNames) for known cheats; matching names now add +1000 to the score and instantly trigger CHEAT DETECTED.
• Expanded – Exact-name logic wired into Prefetch, BAM, MUICache, CS:GO/CS2 folders, Downloads, Desktop, Recycle Bin, USB traces, Amcache, Shimcache, and RunKeys.
• Updated – Processes and modules scanner so both process names and loaded modules participate in exact-name and fuzzy detection rules.
• Improved – Browser history engine with better multi-profile support for Chromium/Firefox-based browsers and clearer separation between cheat sites and cheat-search queries.
• Tuned – Centralized verdict rule around Score >= 999 for hard CHEAT DETECTED, while keeping weaker signals in SUSPICIOUS.
• Stability – Hardened error handling for locked/denied files so scans complete even when some locations are inaccessible.

First version that connects the Windows client to the live AACGUARD web panel with real-time stats.

• Added – Dashboard stats: total scans, unique players, total flags, last 24h detections, and last scan timestamp from the scans table.
• Added – Detected-players listing with verdicts and basic scan metadata for server admins.
• Improved – Logging format so each scan is consistently tied to Steam ID and verdict on the panel.
• Fixed – Client startup issues on some Windows 10 setups where scans could fail silently.
• UI – Landing page hero now shows live stats and last 24h detections instead of placeholder numbers.

First public Windows client and PHP/MySQL panel release for community testing.

• Added – User-mode Windows client designed to be VAC-safe.
• Added – Core forensic checks for CS:GO / CS2 (configs, game directories, basic file traces, processes).
• Added – Score-based verdict system with CLEAN, SUSPICIOUS, and CHEAT DETECTED outcomes.
• Added – PHP/MySQL backend storing scans with Steam ID, scan time, and verdict.
• UI – First AACGUARD landing page with download CTA and “how it works” explanation.