Posted: 13-03-2018, 06:47 PM
(This post was last modified: 13-03-2018, 06:47 PM by Fazer.)
This SS guide will give you the maximum chance of finding any sort of cheats when screen sharing a player on the network. If you follow this guide you are almost guaranteed to find if the player is using any cheats.
If you suspect a player of cheating then freeze them or use the command “/ss <Player>” and give them 3 minutes to join the Teamspeak. (ts.faithfulmc.com) If they fail to join the teamspeak then ban them for Refusal To Screen Share. Make sure to -s the ban. If at this point they have joined Teamspeak then ask them if they would like to admit for a shorter ban. If they do admit check the punishments (Here) and ban them accordingly. If they do not admit then from that point give them 3 minutes to download Anydesk ( https://anydesk.com/download ) and give you their anydesk address.
Once they give you the 9 digit code follow these steps below.
Once they’ve opened the Anydesk and allowed you mouse and keyboard access then check if they’re recording by clicking the the Up Arrow in the bottom right of their screen which looks like this https://gyazo.com/18967f9e7b99708f2f7411e987b9341f and check if you find any Recording Software looking icons. If you find any, simply open them and check if they’re recording then close the recording software incase. After that check if they have CCleaner. If they do, Check if they’ve ran it before the Screen share by opening ‘’File Explorer’’ then ‘’Recent Items’’ and if there’s nothing there they’ve used CCleaner before the joining Teamspeak and you can Ban them. If not go back to Minecraft.
BEFORE SSING, CHECK RECORDING
Open up Minecraft and unfreeze the player. Click ‘’ESC’’ then options, then open up Snooper Settings and scroll down till you find ‘’launched_version’’ (almost at the bottom) and find out what version they launched their Minecraft in. If they are using a Hacked Client ( Jigsaw, Huzuni,
Pandora, Sigma, etc.. ) then ban them, but if they are using Forge etc... then continue by going into their .minecraft then into their mods folder and checking for any illegal mods/Reach/Client Mods. Make sure that all the mods have the correct file sizes. File sizes are below.
205KB= Zuiy’s old client
20KB = Misplace
TCP No Delay
TCP No Delay (1.7.10)
37.41-38KB = Client(Vea)
974KB - 1,194KB
1,356KB - 1,580KB
1.26 - 1.27
24KB - 27KB
1.27 - 1.28
26KB - 27KB
1.0 - 1.1
252KB - 260KB
After checking out their Mods and figuring out if they have any Mod Client/Reach Mod/Misplace client go back to their File Explorer and go through their Downloads, if you find any sort for Ghost Clients you may ban them. You can also open a random winrar file then right click on the logo
And check if they have recently opened some sketchy files/clients. After that you can also check Prefetch by going into This PC - Windows - Prefetch and going through it checking if they have any weird file names/Autoclickers recently opened. Once you’re done doing that you can move on to downloading some tools to help you with the Screenshare.
Download Process Hacker by clicking the link above then clicking ‘Installer’ - Run - Next - Next - Install - Finish
Always start of the Process Hacker by going into his chrome.exe if that's their Net Browser of choice.
Right click on the top chrome.exe then click Properties - Uncheck ‘Hide free regions’ - Strings - Minimum length = 4 then tick Image and Mapped Click Filter - contains (case-insensitive)... - And search for stuff like
To get a better idea of what they may be using.
If you’re searching for an Autoclicker go into - dwm [dwm may need you to run Process hacker as an administrator to actually show strings] (
- Uncheck ‘Hide free regions’ - Strings - Minimum length = 4 then tick Image and Mapped.
Click Filter - contains (case-insensitive)... - And search for stuff like
You can also go through the same process by using explorer instead of dwm
If you’re searching for a Ghost Client go into - (javaw - Uncheck ‘Hide free regions’ - Strings - Minimum length = 4 then tick Image and Mapped.
Click Filter - contains (case-insensitive)... - And go through these strings.
These strings will almost always ensure that you find the players Client if it’s one of the clients stated above(Possibly not the Vape Strings) .
More detail will be added as I find more detection methods.