If you downloaded a game cheat, hack, loader, or suspicious mod, treat it as a possible security incident rather than simply deleting a folder. This checklist explains how to isolate the device, protect gaming and email accounts, preserve useful evidence, and decide whether a normal cleanup is enough or a full reset is safer.
Overview
Cheat loaders and unofficial mod tools can be risky because they often ask for administrator access, disable security software, inject files into games, or require you to sign in through an unfamiliar page. A file may also be unsafe even if it appears to work, comes from a gaming community, or is described as “undetected.” The immediate goal is not to investigate the software yourself. It is to limit what it can access and secure accounts from a device you can trust.
Use this order:
- Stop interacting with the file. Do not open it again, test a new version, enter credentials into its launcher, or follow additional instructions from its seller or Discord server.
- Separate the device from the internet. Disconnect Wi-Fi or unplug Ethernet. If the computer is used for work, school, banking, or shared storage, isolation is especially important.
- Protect accounts from a clean device. Use a phone or another computer that was not exposed to the download to change passwords, revoke sessions, and enable multifactor authentication.
- Scan and assess the affected device. Use built-in security tools and reputable, current security software. If the system continues behaving strangely, consider professional help or a complete operating-system reinstall.
Do not assume that a game ban and malware infection are the same problem. An anti-cheat alert may be a platform or game-integrity issue, while stolen credentials or unauthorized programs may create a separate security risk. For background, see our guide to how anti-cheat software works and review the game’s official support channel for account or ban questions.
Checklist by scenario
You downloaded the file but did not run it
Do not open it “just to check.” Disconnect if the download came from a suspicious source or if your security tool has already raised an alert. From a trusted device, change any password you entered on the download page or related community site. On the affected computer, delete the download only after recording its filename, location, source, and the security alert. Emptying the recycle bin can remove the obvious copy, but deletion alone is not proof that the system is clean.
Run a full security scan after updating the operating system and security definitions. If a security tool identifies the file, follow its quarantine or removal instructions rather than trying to bypass the detection. Do not upload a suspicious executable to a public forum or share it with friends.
You ran the loader, mod, or installer
Disconnect the computer from the internet and stop using it for shopping, banking, email, or account recovery. If the program requested administrator permission, changed security settings, or installed a driver, treat the event as higher risk. From a clean device, change the password for your primary email first, then your gaming platform, game publisher, Discord or other community accounts, and any account that reused the same password.
Use each service’s official security page to sign out other sessions, remove unfamiliar devices, review connected applications, and replace recovery details you do not recognize. Enable multifactor authentication where available, preferably with an authenticator app or security key. Save backup codes somewhere secure. If you used a card or payment account after running the file, review recent activity and contact the provider through its official channel if anything looks unfamiliar.
You entered credentials into a cheat site or launcher
Assume the credentials may have been collected, even if the login failed. Change the password from a clean device and change it anywhere else that used the same or a similar password. Secure the email account before the game account because email access can be used to reset other services. Check for forwarding rules, unfamiliar recovery addresses, new app permissions, and messages sent without your knowledge.
You received a ban, warning, or suspicious login alert
Do not download a second tool that promises to remove a ban or “clean” your account. Save the notification, case number, date, platform, and relevant screenshots. Contact the game or launcher through its official support process. Avoid arguing in public channels or sending passwords, session tokens, or remote-access codes to anyone claiming to help.
If you need to report the original download, preserve the seller name, webpage, message links, file name, and timestamps without running the file again. This evidence can help a platform, security provider, or law-enforcement contact understand what happened. Our guide to preserving evidence when reporting cheating covers the same basic principle: document first, alter as little as possible, and use the official reporting route.
What to double-check
After the first scan, check for changes that a simple uninstall might miss:
- Startup items: Review applications that launch with the operating system. Disable or investigate entries you do not recognize, but avoid deleting system components unless you know what they are.
- Installed programs and drivers: Look for software installed around the time of the download, including unfamiliar launchers, services, virtual devices, or kernel-level components.
- Browser extensions: Remove extensions you did not install and review saved passwords, active sessions, and notification permissions.
- Security settings: Confirm that real-time protection, firewall settings, and system updates are enabled. If the suspicious program disabled protection, record that detail and scan again after restoring it.
- Account activity: Review recent logins, inventory or trade history, messages, friend-list changes, purchases, and linked applications on each gaming platform.
- Other devices: If the same account was open on a phone, tablet, or second computer, sign out unknown sessions and check those devices as well.
Warning signs that justify a deeper response include repeated detections, unknown administrator accounts, persistent pop-ups, browser redirects, unexplained performance changes, disabled security tools, or account activity that returns after password changes. In that situation, back up only personal documents and photos after checking them, then consider a clean operating-system reinstall. If you are unsure how to do that safely, consult a qualified technician.
Common mistakes
Running the file again to confirm the problem gives the software another opportunity to act. A screenshot, filename, and security alert are safer evidence than repeated testing.
Changing passwords on the potentially infected computer may expose the new passwords if the device is compromised. Use a clean device whenever possible, beginning with email.
Using the same password with minor changes does not reliably protect an account. Use unique passwords stored in a reputable password manager.
Relying only on an uninstaller can leave behind startup entries, drivers, extensions, or account access. Scan, review sessions, and check system changes separately.
Trusting “recovery” sellers can turn one incident into another. Official support pages will not need your password, one-time code, or remote-control access to review a case.
Ignoring fair-play rules after cleanup is also a mistake. Remove unauthorized tools before returning to competitive play and check the game’s current rules. Our competitive gaming integrity checklist can help review software, hardware, and account habits before you queue again.
When to revisit
Return to this checklist whenever you download an unofficial loader, mod manager, cracked utility, or file that asks for unusual permissions. Revisit it immediately after a malware alert, unexpected login notification, password-reset email, missing inventory item, unexplained purchase, or anti-cheat warning. It is also worth checking after major operating-system, launcher, or security-tool changes because menu names and recovery workflows can move.
Before seasonal events, tournaments, or a new competitive game release, review your installed software and linked accounts. Remove tools you no longer use, update the operating system, confirm multifactor authentication, and save the official recovery links for your main launcher and email provider. If you suspect an active compromise, prioritize isolation and account protection over returning to the game quickly. A cautious pause is cheaper than trying to recover an account after credentials, payment details, or digital items have been taken.
