Why Deleting a Cheat Doesn't Erase It: What Windows Remembers

A common belief is that deleting a cheat before a scan makes the PC clean. It doesn't. Windows keeps several records of which programs ran and which drives were connected, for its own reasons: faster startup, compatibility fixes and showing friendly program names. These records stay after the program is gone. This guide explains the main ones, what they store, and how AACGUARD uses them fairly.

Prefetch

To start programs faster, Windows records which files a program loads when it starts. These records live in C:\Windows\Prefetch, one .pf file per program, and include how many times it ran and the times of its most recent runs. A deleted loader often still has its Prefetch file.

BAM (Background Activity Moderator)

On Windows 10 and 11, the BAM service keeps, for each user account, a list of programs with the last time each one ran. It sits in the registry under HKLM\SYSTEM\CurrentControlSet\Services\bam. Because it stores a run time per program, it is one of the clearest signs that something actually ran, and when.

AmCache

AmCache (C:\Windows\appcompat\Programs\Amcache.hve) is part of Windows' compatibility system. It records programs that were present or run on the system, often with a hash of the file. A hash identifies a file even if it was renamed, which is why renaming a known cheat doesn't hide it.

ShimCache (AppCompatCache)

ShimCache is another compatibility record, kept in the system registry. It lists executables Windows has seen, together with the file's modification time. Its times are file times, not run times, so AACGUARD uses it to show that a file existed rather than when it ran.

MUICache

When you run a program, Windows remembers its friendly name for display, per user, in the MUICache registry key. The entry includes the full path of the program, which often reveals folders like "Desktop\cheats\loader.exe" long after they were deleted.

USB history

Windows remembers USB storage devices that were connected, with their names and when they were last seen. Bringing a cheat on a USB stick and unplugging it afterwards still leaves a record that a drive was there. AACGUARD shows device names and connection times, and masks serial numbers on public pages.

The Recycle Bin and recent deletions

Files in the Recycle Bin are not deleted yet, and Windows records when items were deleted. A cheat deleted minutes before a scan is a stronger signal than one deleted months ago.

How AACGUARD uses these records fairly

• Age matters. Old traces count less than recent ones, so someone who stopped years ago is not judged like someone who cheated yesterday.
• The right game. Traces of cheats for another game are shown but not counted for the game the scan was for.
• No guessing from names alone. A file name that merely sounds like a cheat can never produce CHEAT DETECTED by itself.
• Legitimate tools are recognised. The three-stage trust model removes the weight of known legitimate software.
• Only what's needed is uploaded. These records are read on your PC; only findings that match cheat software are sent, never your documents or file contents. See the Privacy Notice for the full list.

Can these records be cleaned?

Some can be cleared by hand or with "cleaner" and anti-forensic tools. AACGUARD looks for those tools too, whether they are installed, running or were run recently, and reports them, because wiping Windows' records right before a scan is unusual on a normal gaming PC. The honest way to a clean scan is simply not to run cheats.