> Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what.
I think a no-brainer solution here, which I am surprised isn't used, is to just immediately kick the account when a well-known signature, such as CheatEngine, is detected. If the program isn't even attempting to get around VAC, there is no point in doing the whole "delayed ban" thing.