QUOTE(eh. @ Jan 23 2005, 11:48 AM - Edit1: typos))
File level scanning has never been confirmed; FWIW(==nothing?) I don't believe M$ does it for every connection (possibly any) and personally I don't think they have in the past nor will in the future eh! Here's why...
In October some folks had their accounts terminated (not just a ban!) re. their xboxdash.xbe being a default.xbe they'd cold booted via. New memory checks could have easily identified this method; checksumming wouldn't have been necessary. (I'm sure a lot of "wtf I'm banned" posts would have appeared on this board if xboxdash.xbe was being validated; hardly any did.)
Also in October, boxes being used by previously "flagged" GT's were potentially scrutinized, resulting in the majority of bans at that time. There's no real evidence of this though, but still to this day there's occasionally a report of it apparently happening. (Lots of posts appeared in the Live and chip forums about this at the time, some of them confirmed that replacing their eeprom like they had before didn't work now...)
Since November, previously non-banned boxes have apparently been banned due to a HD change having been tracked since Live 3.0's release, or thereabouts (which has become known as the "Marriage theory"). This has been the only proven ban cause, other than going on live in a modded state (which now includes a modded xboxdash.xbe being in memory during the connection/validation).
The biggest risk to XBL'rs with modded components on their disks is that M$ may be doing random checks too, potentially including checksums of critical files. No one knows, so it will always be a gamble (and the stakes are higher with UDE2 I suspect) eh...
Edit2: I forgot to mention that I think human error or
potentially package glitches are more likely causes of a ban than almost all exploit methods are eh! (The following linked thread reminded me eh:
_
_)