Windows Event Logs
Utilizing Windows Event Logs (evtx) for detecting cheats and ghost clients during Minecraft and FiveM screenshares.
Introduction to Event Logs in Screenshares
Windows Event Logs are inherently tied to deep system processes, driver creations, memory allocation crashes, and device I/O actions. When performing a "screenshare" or "PC check" on a suspected cheater (especially in FiveM or Minecraft), users will often delete their executable files before the screenshare begins.
While artifacts like Prefetch and Journaling reveal file execution logic, Event Logs capture the residual side effects of those executions. This document highlights key indicators generated by a suspect executing an injection client, deleting their files, and hiding their presence.
Because Event Logs can be manipulated or deleted in their entirety, the first step of any screenshare check involving Event Viewer is establishing whether the logs have been tampered with. If the System or Security logs have less than an hour's worth of records on a PC that has been online for a long time, the user is automatically banned for tampering.
Core Event Log Categories
Of the dozens of available logs, four files located in %SystemRoot%\System32\Winevt\Logs\ are used near universally in cheat verifications:
javaw.exe (Minecraft) or FiveM.exe.Time Manipulation (4616)
Advanced ghost clients are sometimes hidden among normal files. When an attacker modifies an old file or downloads a new client, they will sometimes use "Timestomping" techniques or change their PC clock to make the file's modification timestamps appear as if it was installed years ago.
# The system time was changed. Event ID: 4616 Source: Microsoft-Windows-Security-Auditing Previous Time: 2024-11-02T14:45:00.000000000Z New Time: 2021-05-19T20:23:01.000000000Z Process Name: C:\Windows\System32\cmd.exe
Cleared Event Logs (1102 / 104 / 3079)
Users who utilize basic cleaner bat scripts to wipe Prefetch and Temp folders often also run scripts that execute wevtutil.exe cl System, Clear-EventLog, or fsutil usn deletejournal. When an Event Log is wiped, Windows obligingly records a final entry noting that the local log has been cleared.
| Event ID | Log | Indicator Details |
|---|---|---|
| 1102 | Security | "The audit log was cleared." Identifies the user account that ran the cleanup tool. |
| 104 | System | "The System log file was cleared." Frequently hit by generic FiveM cleaning tools. |
| 3079 | System (Ntfs) | "USN Journal cleared." Indicates attempts to wipe traces of file execution or deletion tools. |
In almost every community screenshare standard, finding an Event ID 1102 generated within the last 48 hours is considered an automatic refusal to screenshare and an instant ban. There is no legitimate reason for a normal player to be scrubbing security audit logs.
Driver and Services (7045)
To bypass anti-cheat protections (such as FiveM's adhesive or server-side Minecraft checks), external clients must map into the game's memory space using a custom Kernel Driver (.sys) or proxy service wrapper. Loading these drops a breadcrumb in the System event log.
ksdkdkdk.sys, iqvw64e.sys). Check the ImagePath. Usually points to an AppData or Temp folder.Kernel Mode Driver to bypass Windows Defender before mapping memory into javaw.exe. A 7045 log showing a random .tmp file installing a service is an immediate ban.USB Usage (20001 / 1006)
A classic tactic is for the cheater to place their client on a USB flash drive, load the client on the title screen, inject it, and then rip the USB drive out before entering the SS (Screenshare) voice channel.
- Event ID 20001 / 20003 (DriverFrameworks-UserMode): Logs when a USB Mass Storage device is connected and enumerated. If a USB is plugged in mid-session and unplugged immediately before the checking admin joins, it proves extraction.
- Event ID 1006 (Microsoft-Windows-Diagnostic-DPG): Volume mounting trace logs. Correlate the mapped Volume ID to any suspicious `Prefetch` executions (Section D evidence).
Pro Tip: Use the Registry (HKLM\System\CurrentControlSet\Enum\USBSTOR) side-by-side with event logs to get the device's friendly name and serial number.
Application Crashes (1000 / 1001)
Cheap ghost clients are notoriously unstable. When an injector fails to allocate memory or writes to protected game memory improperly, the game will crash. A crash does not just close the game — it logs an Application Error.
# Application Error Faulting application name: javaw.exe, version: 8.0.51.16 Faulting module name: ntdll.dll, version: 10.0.19041.662 Exception code: 0xc0000005 ← (Access Violation) Fault offset: 0x0000000000021cd0
Tooling & Triage
During a fast-paced screenshare, manual Event Viewer triage is too slow. Utilizing automated or streamlined search tools is critical for spotting these Event IDs.
| Tool | Use Case |
|---|---|
| native Eventvwr.msc | Slow, but present on all PCs. Can be used to quickly check if logs have been cleared. |
| PowerShell Get-WinEvent | Fast filtering. e.g., Get-WinEvent -FilterHashtable @{LogName='System';ID=7045} -MaxEvents 10 guarantees a fast result. |
| Everything Search | Look for downloaded .evtx files, or cheat logs generated right next to crashes. |
| Echo / Ocean | Premium screensharing tools that automatically flag missing logs and parse these exact IDs behind the scenes for you. |