Seagull.exe .. Anyone know what this is?
SkinsFan
and it lists "Seagull.448" but not "Seagull.exe". I'm just wondering if
the item you listed is concerning the ".448" variety. It states that
its occurence is "rare" and that it does indeed infect ".com" files and
it is memory resident.
Once again, the big question is how my employees were able to d/l
something that contained this virus (if the ".exe"-version IS a virus..)
since they are blocked from d/l'g ANYTHING (or so I thought!).
"" wrote:
>
> On Sat, 21 Apr 2001 12:12:41 -0400, SkinsFan <nos...@nospam.com> wrote:
> > I recently found this program running on one of my office computers.
> > I'm not sure how it got there, or what it is. My employees are blocked
> > from downloading and installing software, and making any changes to the
> > computer. How did it get there, and what is it?
> >
> > TIA
> Hi,
>
> I found these with Copernic Pro, thought the first one was interesting
>
> Name:
> James Coltrane - Tuesday January 16, 2001
> Email:
> af...@hiwaay.net
> Comments:
> Hi
> I am trying to find a registry for the seagull icon. This icon showed up in my last registry check on my computer. This
> icon had a file Seagull_Exe. attached to it, and properties says its a windows system application file. There were
> two other files with a different icon associated with this file. I am trying to find out where it came from. I cannot open
> this file, and cannot delete it. Please help, if you are so inclined!
> I have been comming up empty on all efforts to
> find out about this file, and I am going nuts trying to find answers withiut any clues....
>
> End of First:
>
> This site in Japanese I think has an app by that name, apparently for download:
>
> http://www.x-media.co.jp/XBOOK/BINFO/BOOK/PH4wMM/MMPH4w5/MMPH4w6.html
>
> End of Second
>
> This one is an FTP Index with the same file name listed:
>
> http://www.x-media.co.jp/DATA/PH5wMM/
>
> End of third
>
> Two more went to the same Japanese site for a different version of
> Photoshop.
>
> Slim pickings with even Copernic Pro, but that was the fast search.
> Next, I did a full, detailed serach, and it didn't come up with any more
> sites.
>
> Searching in Software I found this (you didn't want this one)
>
> Seagull.448
> It is a dangerous memory resident parasitic virus. It copies itself to the
> memory at the address 9000:0000 and does not fix MCB list, that may crash
> the system. Then it hooks INT 21h and writes itself to the beginning of
> COM files that are executed. It decrypts and displays the string:
> SeaGull.448
>
> Fourd at: http://www.avp.ch/avpve/file/s/seagull.stm
>
> End of this one
>
> Then I found: http://www.avp.ch/avpve/s.stm
>
> which essentially lists the virus info above.
>
> Sorry, other than a large software company named SEAGULL (all caps)
> I didn't find anything else.
>
> RRRambo
<RRRambo>
> Thanks. I ran a check on Seagull with the latest defs from Norton AV
> and it lists "Seagull.448" but not "Seagull.exe". I'm just wondering if
> the item you listed is concerning the ".448" variety. It states that
> its occurence is "rare" and that it does indeed infect ".com" files and
> it is memory resident.
>
> Once again, the big question is how my employees were able to d/l
> something that contained this virus (if the ".exe"-version IS a virus..)
> since they are blocked from d/l'g ANYTHING (or so I thought!).
>
>
>
> "" wrote:
> >
> > On Sat, 21 Apr 2001 12:12:41 -0400, SkinsFan <nos...@nospam.com> wrote:
> > > I recently found this program running on one of my office computers.
> > > I'm not sure how it got there, or what it is. My employees are blocked
> > > from downloading and installing software, and making any changes to the
> > > computer. How did it get there, and what is it?
> > >
> > > TIA
Hi,
Well, when I searched with Copernic Pro I tried Seagull.exe and got all the info
on the program for various versions of PhotoShop with software listings, but it
was all in Japanese, of course. Other than one FTP site, that was all I found.
When I searched for just Seagull, that's when the virus info and the large software
company showed up.
I don't have an answer, however, the first post message from early this year might
be a clue. Have you tried to email the fellow? He may have since found out what
it was. He appeared to have the same problem you have, not being able to ID this
mystery software.
RRRambo
Sean Skelly
I think i have this program. It's called "Kidproof". I once forgot
the password for this program
and all i could get to was the profile that i had set up for my
son who was 3 at the time. I was literally
locked out of my own computer. I had to backup my data through
dos and reformat my hard drive! I use this
utility at home and feel very safe that my kids won't screw something
up when i'm away at work.
The reason your post caught my eye is when i hit ctrl-alt-delete
to bring
up a list of programs running, Kidproof is shown as seagull. It
does some serious registry editing to keep
defined users out of certain areas on your computer. It requires
a password to change the settings or even to
uninstall it. Don't try to manually delete this program! The settings
will not change! Check the website.
http://www.soskidproof.com/default.asp