HLGuard Configuration Help

Team Fortress Classic Internet Set up Options

Files and execs to use

hlguard.cfg
   exec hlguard/hlg_net.cfg

hlg_net.cfg
   hlg_uaexec hlguard/hlg_checks.uacfg
   hlg_uaexec hlguard/hlg_tfc.uacfg

Team Fortress Classic users will need to comment out hlg_uaexec hlguard/hlg_cs.uacfg by adding // to the beginning of the line. Then remove the // at the beginning of hlg_uaexec hlguard/hlg_tfc.uacfg.

Don't forget to reload hlguard configs (hlg_load hlguard/hlguard.cfg) or restart your server (always the safest and surest method).

Nemesis TFC Client Hook Detection

Nemesis version 1.5 and 1.7 (no idea what happened to 1.6) are detectable by hlguard. I must stress that not everyone regards Nemesis as a cheat, you as admins must decide whether to allow the use of Nemesis on your TFC servers.

As default Nemesis detection is NOT enabled, you must enable it. To do this enable this line (by deleting the first // characters) on this line in hlg_net.cfg:

// hlg_uaexec hlguard/hlg_nemesis.uacfg

The actions performed by a positive Nemesis detection are hlg_actions "n:found" and hlg_action "w:found". Which means it's flagged up on screen and logged to CheaterList.txt. The config team have offered you 3 other possible actions when Nemesis is found, these are:

// hlg_action "n:found:10" "banid 0.0 %w kick;wait;writeid;hlg_setcounter check up" // perm ban
// hlg_action "n:found:10" "banid 60.0 %w kick;wait;writeid;hlg_setcounter check up" // 1hr ban
// hlg_action "n:found:10" "kick #%u;wait" // kick

These are self explanitory, if YOU wish to take more action than say a person is using Nemesis then enable ONE of the above lines by removing the first // and then reload your config.

Logging

By default hlg_net will log to the following files and in the format displayed:

Aimbot Warnings

Aimbot warnings - logged to mod-dir/aimwarn.txt in format %d %h -> %n WONID: %w IP:%i %r warning#%c (%y, HLG %g at %a/%k)

which translates to - 05/01/2002 21:44:56 -> Newbie WONID: 0767973 IP:192.135.239.36 aimbot warning#1 (aim#1, HLG 1.01 at 30/3)

Aimbot Detections

When a player fails enough warnings the detection kicks in, this logs as follows:

1) Logged to Half-life logs as "%n<%u><%w><%i> aimbot suspected"

Which translates to - Bob<12><0101001><192.168.0.1> aimbot suspected

2) Writes to CheaterList.txt as %d %h -> %n WONID: %w IP: %i Suspected Aimbot Banned for 60 minutes

Which translates to - 01/01/2002 18:25:58 -> Iceman WONID: 0125091 IP: 192.141.142.216 Suspected Aimbot Banned for 60 minutes

3) Writes to hlglist.htm as %d %h Name: %n Wonid: %w IP: %i Cheat: AIMBOT

Which translates to - 01/01/2002 18:25:58 Name: Bob Wonid: 0101001 IP: 192.58.44.1 Cheat: AIMBOT

Cvar and Alias Detections

When a player fails cvar or alias checks then by default hlg_net logs as follows:

1) Writes to CheaterList.txt as "%d %h -> %n WONID:%w IP:%i %v %r <%y>"

Which translates to - 06/03/2002 20:44:33 -> [EFSS]--Glen Fiddich-- WONID:1501158 IP:212.239.170.103 found derecoil < Active NoRecoil Script>

2) Writes to Half-life logs as \%n<%u><%w><%i>\ %v %r <%y>

Which translates to - \Bob<21><0101011><217.78.09.123>\ found derecoil < Active NoRecoil Script>

3) Writes to hlglist.htm as %d %h Name: %n Wonid: %w IP: %i Cheat: %y [%r]

Which translates as - 04/26/2002 15:04:50 Name: -=oYYo=- Wonid: 194442 IP: 80.14.19.248 Cheat: Active [H4L]Scriptpack Silentrun [silenton]

Optional logging

These are NOT in hlg_net as default and you will have to cut and paste them in (doesn't matter where in hlg_net you put them).

To log output to - hlg_logfile "%M/hlglog.log" - set in hlguard.cfg
hlg_action "w:found" "hlg_log \'\\'%n<%u><%w><%i>\\' %v %r <%y>\'"

To change the format of CheaterList.txt to the old style

Disable this line
hlg_action "w:found" "hlg_writefile %M/CheaterList.txt;hlg_write \'%d %h -> %n WONID:%w IP:%i %v %r <%y>\'"

and copy the line below for CheaterList to write as
Sat Feb 23 12:15:40 2002 Name: Bob from WONID: 010101 listed as detected due to cheat ../ci.dll from Counter-Intelligence 3.0

hlg_action "w:found" "hlg_writefile %M/CheaterList.txt;hlg_write \'%e Name: %n from WONID: %w listed as detected due to cheat %r from %y\'"

CSBL Logging is performed by the following line - www.csblacklist.com
hlg_action "b:found" "hlg_writefile %M/csbl_cheaterlist.txt;hlg_write \'%d:%n:%w:%i:%y\'"

To log banned wonids to hlgbanned.cfg add this line:
hlg_action "b:found" "hlg_writefile \'%M/hlgbanned.cfg\';hlg_write \'banid 0.0 %w //%n on %d with %y\'"

Adminmod speech plugin

This line is for the admin_speech plugin that plays a wav file during the ban. To enable this wav file, install the admin_speech plugin and follow the intructions on how to create a .res file with maps so that the clients download the wav. Then add this line into hlg_net.cfg:

hlg_action "w:found" "admin_command admin_speakall sound/misc/bitedust5.wav"

To write wonids to hlgbanned.cfg for AIMBOT detections, add this line:
hlg_aimbot "hlg_writefile \'%M/hlgbanned.cfg\';hlg_write \'banid 0.0 %w //%n on %d with aimbot suspected\'"

To write AIMBOT detections to hlglog.log, add this line:
hlg_aimbot "hlg_log \'\\'%n<%u><%w><%i>\\' aimbot suspected\'"