Traziz, you
are an idiot, so away with you!
1. The Megaupload link is a package that contains, to the byte level, the same files as the GCW download of the same trainer. You didn't attach anything, although I asked you many times. We're still yet to see an "infected" xpsupport.dll with the (alleged) "llsass" string.
2. Epic fail. You think it's cocodrilo's bad English that you don't understand him. Actually, you cannot read plain English either. Had you gone to the linked webpage (
http://www.softsclub.com/games/97811...0-trainer.html, in case you cannot find it in the original post), which is in pretty simple English, you would've found out that the hxxp://www.multiupload.com/ID3HMZBEXK link, the one to the suspicious F.E.A.R. 3 trainer, is at its bottom. cocodrilo's reference to the Multipload link was not that this link is a genuine Sicheats trainer, it was some help with finding out the Multiupload download link at the bottom of the Softsclub webpage.
3. Again, no files attached. Yeah, this file is compressed, that file isn't; this file is encrypted, that file isn't; this file is .NET, that file is Delphi; this file is infected, that file isn't; this file contains suspicious strings, that file doesn't. But no actual files that would prove your points just plain bullshit.
4. [...] Oh, fucking great Lord in the heavens above, I finally understood what you meant. In xpsupport.dll/dbghelp.dll, at file offset 0006A487, there's a PUSH 03008468 which points to "lsass" in Unicode; at 0006A49F, PUSH 03008454 which points to "lsass.exe" also in Unicode. There are no extra L's anywhere around these strings. (And, even if there were any, this is an original Windows DLL from Micro$oft, protected by a digital signature, so how could it be infected?!) Another epic fail: you're completely unable to read code either, not even with the help of a disassembler.
From this above, it should be obvious that Traziz has absolutely no idea what he's talking about, while trying to look like an expert in assembly programming. Expert my ass! Permbanned.