Valve Anti-Cheat

Valve Anti-Cheat, more commonly known by its acronym VAC, is a proprietary anti-cheat system developed by Valve for use in GoldSrc, Source and Source 2 multiplayer games, as well as many other third-party multiplayer games on various other engines (such as the original COD: Modern Warfare 2 from 2009).

Valve Anti-Cheat is a shared element of the Source engine; thus, it is supported by any Source-based multiplayer game. Not all Source games use VAC however; for example, Apex Legends uses Easy Anti-Cheat (EAC).

Todo: VAC errors, such as File:Vac blocked.png

List of Games uses VAC

There are currently over 100 games used VAC, according to Steam Store when search for games with VAC. However some of the list may be incorrect, such as singleplayer games being included on the list.

GoldSrc

• Counter-Strike
• Counter-Strike: Condition Zero
• Day of Defeat
• Deathmatch Classic
• Half-Life
• Ricochet
• Team Fortress Classic

Note:If the player is VAC banned in one of GoldSrc games, they will get banned in all of them.

Source

• Counter-Strike: Source
• Counter-Strike: Global Offensive (no longer available)
  • If you receive a VAC ban (for any game) you will no longer have access to the CS:GO and CS2 Store, receive CS:GO and CS2 item drops, or be able to trade CS:GO and CS2 items.
• Day of Defeat: Source
• Half-Life 2: Deathmatch
• Half-Life Deathmatch: Source
• Team Fortress 2
  • If you receive a VAC ban in Team Fortress 2, Counter-Strike: Source, Half-Life 2: Deathmatch, or all Source games, all your items will be removed from your Team Fortress 2 inventory. Steam Support is unable to restore these items. Additionally, you will no longer have access to the TF2 Store or receive item drops.

Note:If the player is VAC banned in one of Source games, they will get banned in all of them.

Source 2

• Counter-Strike 2
  • If you receive a VAC ban (for any game) you will no longer have access to the CS:GO and CS2 Store, receive CS:GO and CS2 item drops, or be able to trade CS:GO and CS2 items.
• Dota 2

Note:If the player is VAC banned in one of Source 2 games, they will get banned in all of them.

Other engines

• All Call of Duty games from 2009 to 2017
• See more at Steam Store

Heuristics

When a player is connected to a VAC-secured server (denoted by a security badge and the letter V in the server browser), the VAC system checks if any foreign processes are hooked into the player's local game binaries. If the VAC check finds a positive ID for any possible cheating tool, the offending player's Steam account is then permanently banned from all VAC-secured servers after a variable amount of time. If the player was falsely banned for using software that are not a cheating tool (such as Recording software, overlays, drivers, etc...), or by launching the game with updated game DLLs files which was mistakenly marked as cheating tools/DLL injectors, the player may get unbanned by Valve.

One example of false positive VAC ban, in this case with COD: Modern Warfare 2, due to DLL files being updated by Steam after it's was loaded by the game, over 12,000 players was banned. These bans have been revoked and those who got affected by the ban have been gifted Left 4 Dead 2 for free by Valve, plus one to send as a gift to friends. Another one, recently, affects most AMD graphics card users with "Anti-Lag/+" feature enabled, which results in false VAC ban in Counter-Strike 2.

Message displayed to a VAC-banned client. Screenshot from Team Fortress 2.

Valve Anti-Cheat will not detect content hacks such as invisible wall textures or bright-colored player models. Server admins that wish to block such activity will need to run a pure server.

Using VAC

For server admins that wish to use VAC, you should run your server with the -secure command line parameter. If you are using the Steam srcds frontend, make sure that the Secure (Valve Anti-Cheat) option is checked.

Code Injection

As a developer there are situations in which you may legitimately wish to inject code into the application process of a game that uses VAC and/or Trusted Mode. In this case you need to ensure that your code injection only takes place when and if the game client application is operated in the appropriate mode in order to avoid the user receiving a ban. Check with the game’s documentation to find out what, if any, settings have to be applied.

Code Injection in CS:GO

If the code you wish to inject is Authenticode signed the CS:GO game client has to be run in “Allow Third Party Software” mode; for any other code the CS:GO game client has to be run in “Insecure” mode.