File Sizes:
File sizes can vary between 1-3 kb, if there’s any more or less than that then look at the mod in JDGui

Bspkrs Core - 194kb
Armor Status - 26kb
Status Effect - 24kb
DirectionHUD 24kb
Rei’s MiniMap 1.7.10 - 178 KB (Without radar)
Batty’s Coordinates Mod - 18kb
Optifine - 930kb, If their kb is higher/lower download that version of optifine and see if it is similar, if it isn’t then check the file in JD-GUI
PlayerAPI - 252kb
Time Changer - 15kb
ToggleSneak - 20-25kb anything above / below is a client.
Schematica -  249kb
CPS Mod - 10kb (If it’s anything below or above 10kb it’s the CPS Mod reach client)
Fastcraft - 179 KB
TCPNoDelayMod - 5 KB
ResourcePackOrganizer - 40 KB


Version Clients


First of all go to Their controls and make them set their Attack/Destroy key to rshift then Grave (The key right under ESC).If nothing pops up then head over their snooper settings and make them scroll all the way down and check if they have anything sketchy (Incognito Cracked and paid will be addressed Later on)See Launcher version and make sure it is allowed now get out of there and go to their resource packs and then to their resource pack folder And click open resource pack folder from there go to their .minecraft now from here make sure they don’t have any sketchy text document like gc or anything with a weird name.then go to versions and check their versions (You should be able to spot out a Minecraft hack client just from snooper settings (Launched version)But in case of serenity That is an optifine Client D6 And H6 (Optifine version 1.8)Now serenity you should be able to detect just through cheatsmasher (Will be addressed)


Ghost Clients



This SS Tool should help you find ghost clients every single program is explained in this ss guide


Harambe / Cracked Vape:

Go to This PC / My PC
Local Disk(C:)
Windows
Prefetch
Type in J and Look for JAVAW
WARNING Only ban If 2 javaw are within 1-5 mins when the first one is

Cracked Incognito
Cheat smasher will detect the cracked version but not premium incog.

It should pop up with a bunch of things like czaarek and javaasist

Process Hacker

A file is included in the SS Tool, just make them install it then go down until you see javaw then right click it go to memory strings 4 Then search for iclient,manthe,dab,czaarek99,harambe,gorilla,updater

If nothing pops up then Change the strings to 8 And search for rundll32 or just rundll if nothing pops up they are using a ghost client (vape does bypass this but premium incognito doesn’t)


Cheat Smasher

Cheatsmasher is not flawless not even close but what it can do is detect some clients like paid spook all you need to do is just download it from here (Clean download)

This folder has everything you will need and everything will be explained down below

(https://mega.nz/#!TMMCgbKZ!9-quwpkSsoELFSUe7Mvzrjlir7LJ2SOFpvb8t-YBe48)

The tools provided in that link will be explained so let's go with levels we will have basic, intermediate, advanced






Basic Detection

Cheat smasher is super easy to use it is in the folder chest smasher just open it up and run the exe make sure you extract all the programs in his desktop if anything with mojang pops up do not ban him if anything like java.lang that is cracked vape and you can ban for it.most of the cheats simply have their name in there.

Search Everything is also a well known program for searching their whole hard drive fast and easy. Open up the installation and just make them run the installer once opened wait for it to scan the C: drive then search for vape, iclient, harambe and gorilla if you find nothing move on this is the really basic



Intermediate Detection

Only use this if you didn't find a client with the basic

You should see a program called schem finder run it if nothing pops up they aren't using hacked schematica then you should see a program called jd-gui pretty much open it and drag all of the mods in there if they have a ghost client hidden in mods you should be able to find it that way once all mods have been dragged in then look at the top you should see search click it and then select every box and search for trigger,killaura, autoclicker,aim assist if you don't find anything move on


Advanced Detection
ONLY COME HERE IF YOU COULD FIND NOTHING IN THE PAST 2 STAGES

So here is where it gets complicated so you should see a folder called 'em editor open it and go through the installation open it up once it is opened open there task manager (find an empty spot in there taskbar right click start task manager. Then find there javaw process right click and create dump file it may take a bit depending on the pc they have once it is done it should pop up with a path copy the path go into it in and then open it with emeditor if it asks open it with asci you will probably understand nothing just control f and search for some hacks if you find nothing search for
.jar MAKE SURE to note down what kind of jars you find if they have let's say optifine d8 and optifine h8 then ban them for it (make sure they are both 1.7.10 or what ever version the person Is playing)


Now to even more advanced create a dump file of their explorer the same way you did with their java just with the explorer now open it up with emeditor and search for Iclient or .jar EVERY SINGLE jar that has been opened should pop up (Notice you MIGHT even find vape with this yes paid vape)So if they are using any injectable .jar client you should be able to find it that way again make sure they don’t have 2 Optifines for the same version or anything like that