Bypassing Screenshares with Whiteout (Method 1, Recommended)

Bypassing Screenshares with Whiteout (Method 1, Recommended)

Nobody wants to get caught cheating! This guide tells you how to prepare your computer for a screenshare.
Screenshare FAQ and General Info "What's a screenshare?" you may ask. A screenshare is something a lot of servers require players suspected of cheating to complete to continue playing on the server. Should you refuse, you will be banned. You'll know you're about to be screenshared when a server moderator "freezes" you on the server. This means that you won't be able to move, and a chat message will usually tell you to join their TeamSpeak server, or more rarely a Discord server. Once you join the call/server voice chat, they'll instruct you to download remote desktop software, usually TeamViewer or AnyDesk. After connecting to your desktop remotely, they'll run a variety of programs to try to find evidence of you cheating. These tools range from kernel-level drivers that scan multiple processes' memory, to simple user-mode programs that show if you've removed a USB or emptied your Windows recycling bin. The screenshare process can take anywhere from 5 minutes, to 2 hours, depending on what server moderator is screensharing you.
Safety Info/Warning As many server staff are children, they may break the rules of the server to try to find proof of you cheating. This may involve viewing your browsing history, or viewing what Discord servers you are in (to try to identify if you're in cheat-related servers). Several of the tools they may run on your computer *may not be safe to run, and can be a massive security risk!* Many of these tools are not made by professionals, or are developed by people with questionable moral integrity. Several of them scan the memory of processes which contain personal information about you-- some even ask you to upload full memory dumps of processes! If during a screenshare you notice staff running a program that you don't recognize or trust, or notice them looking at something you'd rather them not, *just say no!* Your privacy is worth more than a virtual world, trust me. Now that everyone is aware what a screenshare is, outlined below is a guide on how to bypass one with Whiteout.
Step 1: Disable Windows Defender Process (MsMpEng.exe) MsMpEng.exe is a process with several traces that are able to positively identify cheats. To get around this, you may simply disable it. On old Windows 10 builds, you used to be able to disable Windows Defender by creating a simple regedit key called DisableAntiSpyware. This no longer works, as it was patched. If you are on Windows 10 Pro, you may still disable it via Group Policy (not personally tested). Alternatively, you may use this tool to disable it. Direct download Hybrid Analysis of the tool Virus Total of the tool Size of DefenderControl.exe as downloaded on 11/8/2020: 826KB Modified date: Monday, December 16, 2019, 3:49:55 AM Once downloaded, simply open the application and press "Disable Windows Defender". The MsMpEng.exe process should now be gone, and won't come back on reboot. To verify that MsMpEng.exe is disabled (which you should), I recommend a program called Process Hacker 2. It has an extremely wide variety of features, among which is a very nice list of running executables and services. You may download it from here.

Pro tip: If you get the nightly build, it's got a dark theme. Open Process Hacker 2 once it's installed, and press CTRL+K to search, or simply click the search bar in the upper right of the application and search "msmpeng".
If you see a process in the list named MsMpEng.exe (like in the picture), you've done something wrong and you will get detected in a screenshare. If you can't manage to get it disabled, make a support ticket and our staff will help you.
Step 2: Get a USB Drive, and Format it as FAT32 Currently, to be undetected by every screenshare tool, you must run Whiteout on a USB drive (or use our secondary method). This will not be the case in the future, as we have a better method in development, however this works fine for now.
As you can see in the picture above, the file system is formatted as FAT32. This is important! If your USB drive is not formatted as such, right click the drive in File Explorer and press "Format" in the right click menu.

WARNING: THIS WILL DELETE ALL DATA ON THE USB DRIVE! Make your settings look like this:
Hit the "Start" button. It is now formatted as FAT32 and you may proceed.
Step 3: Make the USB Drive Look Normal If everyone starts using this method, staff will catch on pretty quickly. For this reason, ideas you come up with yourself for making your screenshare process unique to you are always superior (if properly tested). As a general guideline, I recommend putting some pictures on the drive, maybe some school papers-- just normal things you'd keep on a USB drive. Also important: make a "Downloads" folder on this drive. Download a bunch of normal things to it over a few days so that it is clear you normally use this USB to download things to. The longer the better. This step will make sense further down (you may read ahead of course).
Step 4: Download Whiteout Now that your system is finally set up for a screenshare, you may download the cheat. If you aren't viewing this website in a private tab, I recommend you clear you web history and do so. Download Whiteout to the USB you formatted. If you made a "Downloads" directory on the USB as suggested in step 3, I suggest putting it there. Rename the Whiteout file to have the same name as another legitimate exe on your computer. It is recommended that you use the name of a commonly downloaded executable file, such as AnyDesk.exe. Once Whiteout is renamed to AnyDesk.exe (or an executable of your choosing), move or download the legitimate executable into the same folder.
As you can see, I have the cheat named "AnyDesk.exe", and the real AnyDesk named "AnyDesk(1).exe". This works for any executable. The more diverse/unique to you, the better. Be creative!
Step 5: Reboot To clear all traces of downloading the files and moving them around and such, it is recommended you reboot your computer after following the above steps. Once you have done so, congratulations, you are now set up to run Whiteout! Simply run Whiteout (named AnyDesk.exe on your USB drive), and enjoy a refreshing, modern, cheating experience.

What to do if Screenshared/Frozen

If you've just gotten frozen by a moderator and have followed the above steps, follow these steps to bypass the screenshare.
Step 1: Self Destruct If you've done all of the above steps correctly, you've got nothing to worry about. Simply close Whiteout to unload and clean traces of it running.
Step 2: Shift + Delete the Whiteout EXE File Navigate to the USB directory that Whiteout is in. Press Shift and Delete at the same time with the Whiteout file selected. A window will appear asking if you want to permanently delete the file. Press "Yes".
Deleting Whiteout this way ensures it doesn't go to your Recycling Bin, whithout having to disable the Recycling Bin (which has its own detection implications; some servers ban for that).
Step 3: Rename the Legitimate EXE File In step 4 of the preparation guide, we named Whiteout as "AnyDesk.exe". We also put the real AnyDesk in the same directory, and it was named "AnyDesk(1).exe". Rename AnyDesk(1).exe to be simply "AnyDesk.exe".
Step 4: Proceed with the Screenshare You are now prepared to bypass a screenshare. Follow the instructions of the server staff, knowing you are safe and will bypass successfully.