Features
Catch the cheaters.
Not legit players.
AACGUARD is a forensic scanner for CS2, CS:GO and CS 1.6 community servers. It looks for real cheat traces, weighs the evidence fairly, and gives admins a clear verdict they can explain to their players.
- Running processes
- Loaded modules
- Execution history
- Files & traces
- Program contents
- Cheat servers
- USB & hardware
- Browser traces
in ~17 seconds
Client scan engine
What the scanner looks at
A full scan only runs when the player presses Start or Restart. The only automatic checks are AACGuard Live, which only looks at what is running right now. Each scan runs 46 checks side by side, grouped here into sixteen areas. Hover a card to see what it means.
Processes & modules
Running processes and loaded DLLs are checked for known cheats and loaders, including 32-bit processes and manually mapped code that tries to hide from normal module lists.
Execution history
Windows keeps records of what ran: Prefetch, BAM, MUICache, AmCache and ShimCache. A cheat that was deleted still leaves a trace here.
Files & traces
Game folders, AppData, Downloads, Desktop and the Recycle Bin are checked for known cheat files and leftovers.
Autostart entries
Run keys and other autostart locations where loaders like to install themselves.
USB history
Traces of external drives, a common way to bring a cheat onto a PC and remove it afterwards.
Game configs
CS2, CS:GO and Steam configs that differ from default, including autoexec.cfg.
Browser traces
Visits to known cheat sites and cheat-related searches, used only as an extra signal next to stronger evidence.
Virtualization
Signs of virtual machines and sandboxes that are used to hide cheats or fake a clean scan.
Program contents
Unsigned programs are read for the game offsets and functions a cheat needs, so a cheat renamed to look like a normal app is still found.
Cheat server connections
Programs connected to a known cheat or loader server right now, in the full scan and in AACGuard Live. No traffic is read.
Windows memory
Windows keeps the programs run since start-up in the memory of its own services, even after they are deleted, renamed or run from a USB stick.
CS 1.6 game files
Wall textures, player models, smoke sprites and game DLLs are compared with Valve's originals: see-through walls and bright models are found without a running program.
Hardware cheats
Arduino boards acting as a mouse, KMBox / Cronus / XIM adapters and DMA cards, counted only when used on the day of the scan.
Linked Steam accounts
Every Steam account used on the PC is checked for VAC, game and AACGUARD bans, so alt accounts of banned players stand out.
Macros & Discord
Macro scripts are judged by what they do (recoil, bhop, colour aim), and cheat files shared in Discord chats are noticed.
Dated evidence
Every finding shows when it happened and how many points it counted, and a clock moved back no longer makes old traces count less.
Cheat-focused
Looks for loaders, injected modules and cheat traces, not overlays, music players or Discord.
Steam-linked
Every scan is tied to a SteamID, Steam name and a clear verdict, so decisions map to real accounts.
Drop-in
Works next to your existing servers and plugins. No special host and no migration of your stack.
Accuracy
Fair verdicts, not guesswork
One suspicious file shouldn't ruin a legit player's reputation. Every finding has a weight, and the verdict looks at both the total score and how many separate detections were found.
- Three verdicts: CLEAN, SUSPICIOUS or CHEAT DETECTED, always with a numeric score.
- Three-stage trust model: findings are re-checked before they count, so legitimate software doesn't push a player over the line.
- Humans decide: admins see all the evidence behind a verdict before they act.
Real case from the technical report
A clean player's score, before and after the trust model
The wrong verdict was corrected automatically, before anyone was banned.
Server attribution
Every scan knows which server it's for
AACGUARD recognizes six games automatically and works out which server the player is connected to by observing the game's network traffic and checking DNS. The result lands with the right server's admins, without the player typing anything.
Since v0.0.12
AACGuard Live, from the moment AACGuard starts
Live starts with AACGuard (and with Windows) and checks every minute what is running on the PC. When CS2, CS:GO, CS 1.6 or another Valve game (such as Team Fortress 2, Dota 2, Deadlock or Left 4 Dead) is open, it checks every 30 seconds what is running with the game right now. It never looks at history, so it stays light.
Injected code
Modules and manually mapped code inside the game process.
Memory access
Other programs that have the game's memory open for reading or writing.
Overlays & proxies
Windows drawn over the game and proxy DLLs placed in the game folder.
Running cheats
Known cheat programs and loaded drivers while the game runs.
Public live status
Everyone running AACGuard shows on the Live page with their status (CLEAN, SUSPICIOUS or CHEAT DETECTED), game and server. A status only gets worse during a session.
Verified with Steam sign-in
Signed in with Steam in the app, your status is marked verified. Not signed in, it is listed under the Steam account on your PC and marked not verified.
Your choice
Turn Live off in the tray menu; it comes back on when AACGuard restarts. Exit AACGuard and turn off Start with Windows to stop it completely.
The desktop app
Always ready in the tray
AACGuard starts with Windows and waits in the system tray, so it's ready before you join a server. Closing the window keeps it there; choose Exit in the tray menu to close it fully. Start with Windows can be turned off in the tray menu.
Tray menu
Status, open the app, quick check, full scan, sign-in, Live on/off and Start with Windows, all from one menu.
Quick check
A few-second look at what is running right now. It stays on your PC and is never uploaded.
Steam sign-in & profile
Sign in through aacguard.com in your browser and see your avatar, FACEIT and Premier stats, and your AACGuard scan totals in the app.
Export your report
Save any scan report as a PDF or web page for your own records or an appeal. Free for everyone.
AACGUARD PRO (optional)
A one-time payment for 1 or 12 months, with no subscription. You get the PRO badge, an animated name on public lists and Fresh Start in the app. PRO never changes how scans are scored and is never needed to scan. See PRO.
Fresh Start (PRO)
Deletes the cheat files a scan finds on your PC, only the ones you tick. It is blocked while a game is open or you are on a server, never wipes Windows' activity records, and later scans show that it was used, so it can't hide cheating.
Data & web panel
Evidence you can show your players
The panel helps admins explain decisions, track repeat offenders, and show players that bans are based on something real.
Masked IPs
IPs are only stored in masked form, for example 2*.42*.**.2*.
Public data wall
An optional public list of scanned and detected players with their verdicts, for full transparency.
Live stats
Total scans, unique players, flags and detections in the last 24 hours, always up to date.
Long-term history
Scans are kept, so admins can spot patterns across weeks and months, not just one scan.
Tech & roadmap
Built for today, aiming further
How it's built
- User-mode Windows clientRuns like a normal app, designed to be safe next to VAC.
- Web panelPHP + MariaDB on a VPS in Germany, connected to the client over HTTPS.
- Edge & analyticsCloudflare for protection, analytics for traffic.
- Updatable detectionsDetection lists are downloaded at scan time, so new cheats are covered without reinstalling.
What's next
- Foundation22 evidence sources, trust model, server attribution, web panel.
- v0.0.12AACGuard Live, tray app, quick check, Steam sign-in & profile, report export, AACGUARD PRO.
- v0.0.138 languages, plain-language findings, false-positive reports, pre-match check links, scan history, update notice, new PRO themes.
- v0.0.14Server owner PIN and window, copy link & open scan page after every scan, faster AppData check, Steam vs non-Steam CS 1.6.
- v0.0.15Program contents, cheat server connections, Windows memory, CS 1.6 file check, hardware cheats, linked Steam accounts, dated and explained findings, scans about twice as fast.
- More artifactsNew evidence sources and faster detection updates.
- Server plugins & APIsDirect integration with game servers and community tools.
- Deeper checksExploring deeper, kernel-assisted checks where possible. Today's client stays fully user-mode.
Tutorial
See it in action in a few minutes
Download, install, run your first scan and learn how to read CLEAN, SUSPICIOUS and CHEAT DETECTED results.
Tip: open the video on a second screen while you run the client.
Every feature is documented.
How detection, scoring and attribution work is published in our technical report, and every release can be verified.