[Esd-l] Anyone have an invariant signature for Goker?

[Jean-Baptiste Massuelles]

> At 08:17 PM 12/14/2001, John D. Hardin wrote:
>
> >On Fri, 14 Dec 2001, Brett Glass wrote:
> >
> >> Anyone have a signature?
> >
> >*.exe
> >
> >(sadly, only partially kidding)
>
> It's not just *.exe though. It can have many extensions.
I founs this info aboute Goker (from http://secuser.com (french site)) :

Le nom du fichier joint (14,3 Ko) est une combinaison de nombres aleatoires
et de chaines de caracteres dont tgfdfg, jhfxvc, cgfd2, trevc, t6tr, ffdasf,
glkfh, fhjdv, qesac, kujzv, weafs, twat, rewfd, gfdsf, hgbv, fdsc, p0olik,
3tgf, rf43dr, t54refd, ut545a, r4354gkjw, vgrewu, xw54re, y343rv, z3vdf,
ainsi qu'une extension parmi .pif, .scr, .exe, .com ou .bat

Which means :
File is 14.3 Ko and a combination of random numbers and of caracter wtring
amoung which :
 - tgfdfg,
 - jhfxvc,
 - cgfd2,
 - trevc,
 - t6tr,
 - ffdasf,
 - glkfh,
 - fhjdv,
 - qesac,
 - kujzv,
 - weafs,
 - twat,
 - rewfd,
 - gfdsf,
 - hgbv,
 - fdsc,
 - p0olik,
 - 3tgf,
 - rf43dr,
 - t54refd,
 - ut545a,
 - r4354gkjw,
 - vgrewu,
 - xw54re,
 - y343rv,
 - z3vdf

It's extension is either .pif or .scr or.com or .bat
(example : rewfdrewfdrewfd65432109876rewfd.pif)

-o-
Juan