Why Renaming a Cheat Does Not Hide It

The oldest trick against anti-cheat scanners is renaming the cheat: loader.exe becomes discord_update.exe. Name lists still matter, but since version 0.0.15 AACGUARD has several checks that do not care what a file is called. This guide explains them in plain words.

1. What is inside the program

A Counter-Strike cheat has to know the game. A CS2 or CS:GO cheat carries the names of the game's memory locations and player fields it reads; a CS 1.6 cheat carries the names of the engine functions it hooks. AACGUARD reads unsigned programs and libraries in the places cheats usually live (Downloads, Desktop, Documents, Temp, AppData, running programs and programs Windows recorded as run) and looks for those names in combination. One word is never enough; it takes several game-specific names together with the game itself.

Only the names that matched and the file path go into the scan. The file itself is never uploaded. Programs signed by a trusted publisher are not judged this way.

2. What Windows remembers since start-up

Windows Explorer and a few Windows services keep the paths of programs started since the PC was switched on, in their own memory. That list survives when the file is deleted, renamed or run from a USB stick that has already been unplugged. AACGUARD reads those paths and reports only the ones that match cheat names. Paths that still exist are then also read by the content check above.

3. UserAssist

Windows keeps a list of programs you started from the desktop, Start menu or taskbar, with the last start time, for every user profile on the PC. The list stays after the program is gone. See What Windows remembers for the other execution records AACGUARD reads.

4. Fingerprints

When a cheat file is still on the PC, the scan log records its SHA-256 and SHA-1 fingerprints. A fingerprint describes the file's content, not its name, so the same file is recognised on another PC whatever it is called. Windows' own AmCache also stores a SHA-1 of programs that ran, even after they are deleted, and AACGUARD compares it with known cheat fingerprints. Fingerprints collected from scans are reviewed by a person before they are used for detection.

5. Inside the game

While a supported game runs, AACGUARD searches the game's memory for byte patterns of known cheats and checks for code loaded without a file. A cheat that is never written to disk is still visible there. See External cheats, overlays and injected code.

6. Who it talks to

Paid cheats stay connected to their license server. AACGUARD checks which program is connected to a known cheat server, whatever the program is called. See Connections to cheat servers.

What this means for you

• Players: renaming, moving or deleting a cheat right before a scan usually leaves more traces, not fewer. A deleted file whose path is still in Windows' memory is reported with the date it was deleted.
• Admins: findings from these checks say which check found them ("what is inside it", "Windows memory since start-up", "fingerprint"). The plain explanation under each finding on the scan page tells you how strong it is.

The design and the limits of these checks are described in our research article Beyond file names.