Reading a Scan Result: CLEAN, SUSPICIOUS and CHEAT DETECTED Explained

Every AACGUARD scan ends with one of three verdicts and a score. This guide explains how that verdict is reached, what it does and does not prove, and how to read the findings behind it, whether you are the player who was scanned or the admin deciding what to do.

The three verdicts

• CLEAN: nothing was found that points to cheating, or only weak traces that the trust model ruled out.
• SUSPICIOUS: there are traces worth a closer look, but not enough independent evidence to call it cheating. This is a prompt for the admin to read the findings, not a ban reason on its own.
• CHEAT DETECTED: several independent findings point to cheat software on this PC, with enough weight to pass the threshold.

How the score works

Each finding has a weight: a known cheat running inside the game weighs a lot, a vague file name weighs little. The verdict looks at two things together, the total score and how many separate detections there are. A single file with a suspicious name can never produce CHEAT DETECTED on its own; name guesses alone are never enough.

Before findings count, they go through a three-stage trust model. Legitimate software that looks like a cheat to a simple search (overlay tools, macro software, game launchers, programs with "aim" or "hack" in their name for innocent reasons) is recognised and its weight is lowered or removed. In one case documented in our technical report, a clean player's score dropped from 395 to 130 after the trust model, turning a wrong CHEAT DETECTED into the correct CLEAN before anyone was banned.

Things that lower a finding's weight

• Age: old traces count less than recent ones. Something used two years ago weighs less than something run this morning.
• Another game: cheats for a different game are shown in the report but not counted for the game the scan was for. A Minecraft client does not make a CS2 player a cheater.
• Whitelisted tools: well-known legitimate programs are recognised and not counted.

Reading the findings

Every finding says where it was found and, where possible, when. Some examples of what you can see:

• Running process or loaded module: a known cheat or loader was running, or code was loaded into the game. This is the strongest kind of evidence.
• Execution history (Prefetch, BAM, AmCache, ShimCache, MUICache): Windows recorded that a program ran, even if it was deleted afterwards. See What Windows remembers.
• Files: a known cheat file in Downloads, the Desktop, AppData, a game folder or the Recycle Bin.
• Browser traces: visits to known cheat sites. These only add to stronger evidence and never decide a verdict alone.
• Virtual machine signs: a scan run inside a virtual machine can be used to fake a clean result, so it is reported.

The scan page also shows which game the cheat traces are for, the server the player was on, and information-only notes (for example a non-Steam CS 1.6 install) that are not part of the verdict.

For admins: before you act

1. Read the findings, not just the verdict. Ask yourself: is this recent, and is it for the game played on your server?
2. Look at the player's history. The player lookup on the home page shows every uploaded scan for a SteamID.
3. For SUSPICIOUS results, ask the player to explain or to scan again. A second scan that shows the same running program says more than a single old trace.
4. Remember that the decision is yours. AACGUARD gives evidence; your server rules decide what happens.

For players: if the result looks wrong

Use Report false positive in the app for the finding you disagree with, and, if the verdict affects you, appeal it from the scan page. Our guide How to appeal a verdict explains what to include so your appeal can be accepted quickly.