Cleaners, Cleared Logs and Clock Changes: Why Wiping Traces Backfires

Some players try to "clean" their PC before a scan. It rarely works, because the cleaning itself leaves traces, and AACGUARD looks for them. This guide lists what is checked and how much each sign counts, so players know what to avoid and admins know how to read it. None of these signs is a cheat by itself: they add tens of points, not hundreds, and they matter most next to other findings.

Signs AACGUARD looks for

• Event logs cleared: Windows writes an entry when the Security or System log is cleared. A recent clear counts as a medium finding; an old one is information.
• Prefetch switched off: Prefetch is Windows' record of programs that ran. Switching it off in the registry or stopping its service hides future runs, so it counts as a medium finding.
• Clock changes: a program that moves the clock can make traces look older. AACGUARD reads clock changes from the System and Security logs, ignores normal time sync and wake-from-sleep corrections, and, when the clock was moved back, stops giving older traces a lower weight. See Dates and points on every finding.
• aacguard.com blocked: a hosts-file entry or firewall rule that blocks AACGUARD or our website is a strong sign. There is no ordinary reason to block an anti-cheat on purpose.
• Test-signing or kernel debugging switched on: these Windows modes allow unsigned drivers to load, which is how many kernel cheats run. Also a strong sign.
• Trace-wiping tools: file shredders and privacy cleaners, installed, running or recorded as run. They are listed with their dates for the admin, as information only: they add no points.

Why a cleaner is not a cheat

Plenty of people use CCleaner or BleachBit to free up disk space. That is why a cleaner adds no points at all. It becomes interesting when it ran just before the scan and other traces show what was there before. Admins should read it as context, not as a verdict.

What cleaning cannot remove

Windows records program activity in many places at once: execution records, the file system's change journal, Windows services' memory since start-up, UserAssist, shortcuts and Jump Lists, Defender's history and more (see What Windows remembers). A cleaner removes some of them, and the deletion shows up with a date in the others.

Fresh Start is different

Fresh Start (PRO) removes cheat files the scan found, so a player who quit can start clean. It never touches Windows' records, and every removal is reported in the player's scans for 30 days. It is designed to help honest players, not to hide anything.

Advice for players

• Don't clean before a scan. A clean PC with old traces is judged fairly by their age; a freshly wiped PC raises questions.
• If you use a cleaner for normal maintenance, say so if an admin asks. The finding's date shows when it ran.
• If you switched on test-signing for development, switch it off before playing (bcdedit /set testsigning off in an administrator prompt, then restart).