TippeX, I can also use Google Translate, thank you very much, but that was not the point. ;) On an English-only forum, people are supposed to write in English and not resort to others translating their posts in whatever language.

I think the threatening with court is kind of an answer to how Cheathappens (allegedly?!) hired a private detective to find out personal data about h4x0r, create a file on him and prepare for legal action. (Not that I'd agree with this at all, it's pathetic...)

The "DRM" bullshit never got out of hand: it was out of hand the very moment it was created. (Thank you for mentioning it because I wanted to add this paragraph.) And I'm not talking about this particular implementation but the very idea. A sane person would think that "Data Rights Management" is about protecting the rights of the users. Fucking wrong! It's not even protecting the rights of authors/developers, rather those of publishers: publishers who are the ones in power but who add nothing substantial to the value of the product, just pass it on from author A to user B, ripping off both, and significantly at that! Therefore, in a sane world, anything that is even remotely similar to DRM should be banned right at its inception. Now this applies to h4x0r's implementation but let's not forget: Cheathappens', too. The notion of DRM is a filthy lie so don't go even near it because it dirties you!

While I was shopping today, something came to my mind that is similar to what TippeX says above. This Cheathappens vs. h4x0r war is similar to the Cold War between the USA and the Soviet Union, with respect to the following: neither side can actually win it, only escalate it to the point where one side will financially collapse and, inherently, give up and kind of "lose". In case it wasn't apparent: I'm referring to Cheathappens as the USA and h4x0r as the Soviet Union in the example.

h4x0r, you don't have as much resources, followers, fans, agents, spies as Cheathappens does so, from a given moment of time, you'll start "losing" and never be able to overtake your opponent anymore. I believe that this moment has already passed so there's no point in competing with them. Don't follow them and don't do anything they do only because they do it, instead show that you can pioneer your own way that has nothing to do with them. I have no idea how respected you are in the trainer scene but getting rid of any kind of connection to Cheathappens would definitely help you.

I hope you'll take advice from someone who is about a decade older and more experienced in the same field as you are and who already saw - and even took part in! - such pointless flame wars. It's a complete waste of resources, nothing more!

By the way, yes, one of the first things I did with the F.E.A.R. 3 trainer was that I launched HTTP Analyzer in the background and also made my firewall alert all kinds of network activity: nothing suspicious happenned.

AFKGun: that hidden process you see running after the trainer is closed is what I was talking about in my first post. It scans for "cheathappens" and then does nice things to anything it finds. Tippex or Joe or anyone else could easily see this if they attach a debugger/scanner to it.

Like Joe said, obviously h4x0r's vendetta against cheathappens has caused him to do some things that the admins of this site should probably take a hard look at, especially if they are hosting and helping to spread these trainers. People like me can only throw up the warning signs but you guys must see it for yourself and take the necessary measures to protect your visitors.

A whole day is gone since you've opened this thread but you still haven't described anything concrete just keep reciting vague suggestions again and again. You're really trying my patience! Don't make me think that you're just another Cheathappens agent!

Ok...'hidden process', how do you see it then? (i will investigate, but not without more info, my time and joes have been wasted before on similar "persuits"... ) rest assured that if this i found and proven to be malicious code against ch then i will be more than happy to provide analysis to ch to assist them in any prosecution as this activity IS viral and illegal in a lot of places and h4x0r will have sealed his own fate (if it is true)..

@Joe. .. Didnt realise the translate was via google..doh

I apologize Joe, I don't mean to piss you off in any way. Like I said previously, analyzing h4x0rs trainers is not a priority of mine (or my responsibility?). I was only stating an observation that I had made. You can believe it or dismiss it and it will be fine by me.

The intention of this thread was to determine what GCW plans to do about this new DRM and see what other users thought about it. I simply added the malware note as it was just something odd that I noticed while looking at the authorization process.

(On a side note, Empire - unlike us, hackers - has a real life, so don't expect him to drop in and reply every hour... well, not even every day...)

understand English but do not write to express myself properly, the only reason to write in Spanish.

Fear is a trainer of 3 with a Trojan, is the same but down from another page. I myself have fallen. that's the big problem down other sites with junk and then say we are.

say that there are no resources, I remember that they have not done anything with the law in their hands. cheathappens encourage you to take legal action, that we laugh all day long.

I am the first that this situation is sickening.

legally you can clarify things in these directions:

http://www.delitosinformaticos.com/1...cias/denuncias

everything else is said in forums, they are just guesses. clarify legally vote and the game ends quickly.

with the law in their hands, in Spanish:

the only one who has committed and continues to commit criminal acts are the people of cheathappens publishing information (in your site) STOLEN AND STAFF. Come on guys, make a complaint because I have really wanted to meet you.


thanks.

the authorization process is only a HTTP PROTOCOL POST, user and password + key. key is information in your profile, encripted with Rijndael and base64 to prevent lost data. ¿more?

So if i downloaded the fear 3 trainer from sicheats (as joe did), it would not contain the trojan... Correct?

@cocodrilo: I sent an E-mail to the address that you used to register on FileForums. (And, no, I don't read or write Spanish.)

I think cocodrilo is suggesting that there's a fake version of the trainer, that can be downloaded from fake sites acting as Sicheats, and this trainer does contain a trojan. Actually, I think I have two versions of the trainer, one downloaded from Sicheats, the other from GCW, and, no, they're not identical. Could the one on GCW be the fake with a trojan inside?! If so, Empire should check (even more) whether Sicheats' trainers have been really uploaded by Sicheats people or by someone else (possibly malicious fakes).

You continue to amaze me. What observation? This: It actively scans memory and HD for anything with the word "cheathappens" and then attaches a viral signature to it so those files no longer function.? So what does it search for: executables or files in general or directory names or what? What is this "cheathappens": general text anywhere in the file, copyright block in executables or what? What happens: a stub added to executables and the entry point redirected, "cheathappens" replaced with "fuck you" or what? Can you send me actual example files?! Or is this something that you've read somewhere - probably, a Cheathappens-friendly site - and fell for it without any suspicion?

I feel as if taking part in the following conversation:
Citizen: (panting) Constable, sir, John killed Fred!
Constable: Now cool down. Have you seen Fred?
- Yes. He was lying on the sofa.
- And was he breathing?
- I don't know.
- Then he could've been just sleeping. Have you seen the weapon?
- Yes, it was a knife.
- And where was it?
- In the kitchen.
- Well, obviously, there are knives in the kitchen. Have you seen John?
- No.
- Now, seriously, have you actually seen John kill Fred?!
- Errr, no.
- Then what the fuck are you talking about?! Let me take your hand, I'll escort you to a mental asylum.

So what the hell am I supposed to think about what you wrote?!

If anyone want to find out the h4x0r trainer's purpose would scan the program for outbound data, destination IP can be detected by 3rd party firewall like ZoneAlarm, and type of data can be capture by WireShark etc.

Seriously how much that i don't get what is going on? So far i only understand h4x0r and CH, one is accusing for code stealing. Seriously, a real hacker wouldn't give a fk for just one code. Unless one is fighting for their life's work.

You getting a feeling of deja-vu joe?

Tippex and Joe: I downloaded the trainer from GCW, not from h4x0r's website. My guess is that after reading these posts, h4x0r removed the malware from the trainers posted on his own site. After the whole fake trainer thing, shouldn't Empire ALREADY only be accepting h4x0r trainers from h4xor himself? You can clearly see why it's pointless to waste time on this as h4x0r can easily control the files on his own website and files from anywhere else (even this site) could POSSIBLY be fake or tampered with.

This whole thing could probably easily be cleared up by a simple post by Empire. He can tell you where the trainer came from (if it DID come from h4x0r, then why does it no longer match the one on his website?) and if he knew about the DRM and if he supports it, etc.

Just on a completely off-topic side note, using the free version of ZoneAlarm is one of the best ways to NOT defend your computer against attacks coming from the network. See http://www.matousec.com/projects/pro...ge/results.php for suggestions on which firewall to use.

He is but there could still be "security holes" in him acting as a "human firewall". Although let me add: none of us - other than Empire and h4x0r themselves - knows how Empire checks this and it's just how it should be.

After how we defended him against Cheathappens, I can hardly believe that he personally would upload intentionally infected versions of his trainers to GCW. And, even if he did, it would become obvious within days, if not hours, that (almost) all Sicheats trainers on GCW are different from the originals and those on GCW (almost) all contain some kind of malware. I find this completely unrealistic!

Sure. And I already answered this, look above.

No no, not in this site. one contains a valid key (already banned) user and password for direct use. in others sites.

this dll is a trainer published in sicheats, for the first templar game:

http://www.sendspace.com/file/w1e1vn

please search for stealt code, malicious code etc. is the only published online trainer with one hit kill option, which I can explain how it works and how to get to separate the player from enemies.

I think people are starting to lose focus on the real issue here. Malware or not, should GCW be hosting files that REQUIRE you to register at a third party site (which may or may not be harvesting your info or might at any time in the future) in order to simply use the file? It's my opinon that files hosted on this site should run independently of any outside program or authentication process. Just because these trainers may not collect or send any data now, that could easily be changed at any point down the road by h4x0r's team once the trainers were being readily accepted and posted on this site.

Off-topic Reply to Joe: Yes I see how it is not recommended but I tried it ZA like 5 years ago and it tracks every program's incoming/outgoing connections in detail, so is useful on that part. I don't really use 3rd party firewall for protection, Windows Firewall somewhat good enough for me. ;)

EDIT: And to addon, h4x0r's trainer need NFO to boot, so modded tr with hex edit? Not quite possible with UPX compressing i think

EDIT2: BOOM! 4 more F3AR v16 trainers added to GCW DL page.

I already wrote that everything that is not caught by the virus scanner as obvious malware is "readily" accepted; it's always been so. If h4x0r - or anyone else, for that matter - wanted to distribute trainers - or any stuff that is on-topic on GCW, for that matter - infected with a trojan via GCW then he or she could've done that years ago. (Although Empire might have some aces up his sleeve for such tricks, I don't know.)

The situation is new and can't really decide whether I should support this kind of trainers. The final word is obviously Empire's but, if we start a discussion about it, then it may take a week or more: we, moderators, have no special "0-second" communication channel to him either!

I have to say, even if a bit reluctantly: yes. But, you see, I'm always open to constructive suggestions so it would be a stupid idea - also see "mindless censorship" - to reject certain ideas right away, I'm rather trying to understand what people are trying to say.

Ohhh, don't worry, I myself have been using ZoneAlarm for years... until I found that page. ;)

Someone uploaded a trainer infected, this trainer IS NOT FROM SICHEATS. This creates a file in system32/adobe/update.exe with image icon, steals passwords from firefox etc.

please check the md5 file with the original from sicheats.

Agreed.... I love the trainers from Sicheats.com, but this kind of stuff is getting on my bad side.... I had the gall (in his mind) to post about it and how it was very suspicious that he called for this (not to mention that some people don't have always on internet connections), and the bastard banned me for doing that!

I am beginning to think that Sicheats isn't the 'white knight' in this and that he might have just as black an armor as Cheathappens.

Log-ins are a dealbreaker for me in my opinion..... free or not, there is no reason to require that and it IS just another form of DRM.

THAT is what I am worried about as well..... I don't want something on my damned computer that needs a connection to the internet just to use the thing. I simply don't..... if there is a PURPOSE behind the internet connection like with a browser that REQUIRES it, that is fine..... trainers? Don't require it in the slightest.

I did that as well, i spoke up about it but h4x0r's banned me for it, which is stupid. This is DRM, I stand up against it because it's stupid, and h4x0r's have doomed himself.

I suggest to leave both CH and h4x0r's war to rot. Is not that we can help in any way and involving just being busybody and to cause flamewar. As for the GCW authorities, i'm sure they will decide what's best for the site.

(The two threads have been merged, turned into a sticky and a a short conclusion added to the first post for the usual lazy reader. If you feel that, after the merge, your post doesn't make much sense anymore then, please, edit it so that readers understand what you're replying to.)

Well, another couple days and still no word from GCW admins regarding this new DRM bullshit. I see they posted another trainer with the DRM on GCW homepage so I assume they will be supporting this crap. Sorry, but I'll be getting my trainers and files elsewhere from here on out, prob game burn world. I would recommend others follow me as long as GCW continues to go against everything the site was built on.

yes agree. can anyone recommend another site to get drm free trainers?

See the appropriate forum sticky for a list of recommended trainer sites.

h4xor is nothing more than a belligerent child. His broken English makes him look like an ever bigger buffoon. He regularly bans users on his site for simply mentioning that they are having issues with a feature on one of his trainers. The other day he banned a guy for asking why he was implementing the DRM and threatened everybody else with a ban if they brought it up again. He's been on a power trip ever since the Cheathappens fiasco. He has basically stooped to their level. I used to defend him but he's turned into a gigantic prick now. This DRM bullshit confirms that.

Yup seems h4x0r is on a self destruct...power corrupts i guess (or the perception of having power)... he seems to be fond of the ban stick on his site too

Here's some proof before somebody starts accusing me of being a Cheathappens cohort or some other nonsense.
http://www.sicheats.com/index.php?ca...d=290#comments Scroll down.

Talk about despicable.

Please, note that, on 2011-06-25, Facebook authentication has been removed on Sicheats.

infected trainer is upload in this page (ALERT IS A TRAINER PLUS 2 VIRUS, DOWNLOAD ONLY FOR ANALISIS NOT EXECUTE):

http://www.softsclub.com/games/97811...0-trainer.html

sicheats trainer is binded to this file, this file is NET with haxor uses delphi 7. this file contains data from author/s to be desencripted soon.

repeat: THIS FILE CONTAINS A VIRUS, NOT DOWNLOAD FOR EXECUTION. joe analyze this and comment please, published 06-23-2011, 11:24 AM.

sicheats publish a clean trainers, with people reupload to other hosts binded..... PLEASE DOWNLOAD TRAINERS FROM SECURE SITES, LIKE SICHEATS OR GCW.

the link of this file is: http://www.multiupload.com/ID3HMZBEXK at te bottom in webpage post.

There have also been generic GUI trainers posted onto YouTube that take users to a site that make you do surveys so they get money and you get nothing in return. YouTube generally takes those down if you flag the video but it goes to show that you only need basic GUI buidling skill to hide malware in them and disguse them as trainers by CHU, h4x0r, or some other 3rd party member.

yeah, I just want to show is that these "trainers" are not from sicheats.

take much time already and no one gives solid evidence, I want a link to a file uploaded by haxor containing strange data or malware. THIS IS A EVIDENCE, sicheats is clean.

Found this in the file xpsupport.dll from the Alice trainer from sicheats

http://img220.imageshack.us/img220/9656/llsassinit.jpg

From what I understand, by backtracing etc, is if the trainer fails authentication, it checks for a process named llsass and if it doesn't exist it creates a file llsass.exe and executes it. And I was a bit bemused as when I search for this file name on google, it came across as a non legit lsass.exe file which is the Windows logon control file, but the counterpart listed in the xpsupport.dll (llsass.exe) is a well known virus/trojan alias. I am not sure if this is what it is, as I am now wary of running any of these trainers now, perhaps Joe_Forster can check?

It is also included in the xpsupport.dll for the "clean" fear 3 trainer provided by cocodrilo

Infact it is in all of their trainers with this xpsupport.dll file.

The trainer also opens up a referral page at uploading.com on the sly..

http://img803.imageshack.us/img803/8...rralhidden.jpg

Also as you see on the image, there is a link to paypal for a donation, why people would want to donate to him only to be banned for saying the trainer doesn't work or asking for help I am not sure.

I also noticed a vcl3test.dll file being created, this isn't a genuine visual c library file, but my visual c is not amazing so cannot say what it does.

ok, analyzing and talking with haxor.

my only 2 trainers published is for civilization 5 and the first templar. fear 3 is not my trainer.

I was talking about the link you provided, a few posts back.

If you could ask h4x0r what the llsass.exe and vcltest3.dll (sorry I said vcl3test.dll before) are for. I think it will ease peoples minds if they also knew what they were for. And why does the trainers access the registry, I have noticed on a couple I have looked at they use registry API's to do so. And also what are the other files created when the trainer runs.

Traziz this dissasemble is not from xpsupport.dll, men check form image base.... like a simple exe..... read a darkbyte text in yor image ;). please provide a xpsupport.dll real from sicheats.

xpsupport.dll is the original dbghelp.dll from windows ;). please make a link to this dll.

maybe ida and ollydbg is wrong.... please download link for debugging please.

it clearly has some interest in lying:). Please update your disassembler WOW.

I used the xpsupport.dll from the Alice trainer from your site, also the xpsupport.dll from the fear 3 trainer from the link you provided which you said was clean.

Also used the fable 3 trainer from GCW which uses the same xpsupport.dll

ok downloading alice trainer from sicheats. wait a moment.

please look :):

is the same file, yor image shows darkbyte string in autoassembler engine.... strange very strange :). please only REAL data and binaries from debugging :p.

please provide a link to binary file with strange code, strings refs or any data to damage you. please a real copy from sicheats servers.

you are lying for some reason.

Goto GCW and get the fable 3 trainer and use that file.

Why you wish to call me a liar when I have tested with 3 independent files from "trusted" distributions points, and they all clearly show the same string references etc.

Is this the normal for people on sicheats to call people liars when it doesn't suit you?

I am sure Joe_Forster will check also, and I am sure he will find the same string reference and coding in all xpsupport.dll files from legitimate safe sites.


Oh wait... are you comparing the coding from the 2nd picture with the xpsupport.dll? The 2nd picture is from the actual Alice trainer and not the library (dll).