UCAE.exe What is it?

Gary

unread,

May 31, 2004, 12:42:33 AM5/31/04

to

I just started getting a message from my Zonealarm Pro that a program called
UCAE.exe is trying to access the internet. I did not grant permission. I
then closed everything and ran Window Washer for a quick clean up. The file
is still there, so I ran Spybot. It found nothing suspicious. I ran
Adaware. It found nothing as well. I searched the net for info on this
file and found nothing. I searched the google groups archive and also came
up empty handed.

I tend to believe that this file is spyware or adware, but since I can't
find any info on it, I am reluctant to remove it manually.

Anyone have any idea what it is?

TIA!

Gary

Vanguard

unread,

May 31, 2004, 1:24:53 AM5/31/04

to

Gary said in news:ZIyuc.7976$2o.3...@twister.southeast.rr.com:

So what do you see described when right-clicking on the file,
Properties, Version tab? In what path is the file found?

--
____________________________________________________________
*** Post replies to newsgroup. Share with others.
*** Email domain = ".com" *AND* append "=NEWS=" to Subject.
____________________________________________________________

Gary

unread,

May 31, 2004, 11:32:30 PM5/31/04

to

It is in the following folder: C:\Documents and Settings\Gary\Application
Data I am running Windows 2000 Pro.

It says only that it is an application and the description simply says ucae.
The file size is 55.6 KB and it was last accessed about 1 minute ago, so I
assume it's running...whatever it is. I have not granted it permission to
access the internet (although it keeps trying) and everything is seems to
still be operating normally.

Does that help?

Thanks!

Gary

"*Vanguard*" <reply-to-...@to-email.use-Reply.obey-signature.invalid>
wrote in message news:Fkzuc.22521$eY2.7087@attbi_s02...

CalamityKen

unread,

Jun 1, 2004, 12:17:31 AM6/1/04

to

Gary typed:

> It is in the following folder: C:\Documents and
> Settings\Gary\Application Data I am running Windows 2000 Pro.
>
> It says only that it is an application and the description simply
> says ucae. The file size is 55.6 KB and it was last accessed about 1
> minute ago, so I assume it's running...whatever it is. I have not
> granted it permission to access the internet (although it keeps
> trying) and everything is seems to still be operating normally.
>
> Does that help?

Looks like a new infection as that is one of the favoured places of the
hijackers.

Get HijackThis and post a log in a support forum. This will help:
http://spywarewarrior.com/viewtopic.php?t=10

Gary

unread,

Jun 1, 2004, 5:52:19 PM6/1/04

to

Thanks! I'll look into it!

"CalamityKen" <YK...@home.invalid> wrote in message
news:srTuc.87177$tb4.3...@news20.bellglobal.com...

Gary

unread,

Jun 1, 2004, 10:45:27 PM6/1/04

to

Hey, I got this information from my Zonealarm about the web site that that
ucae.exe was trying to connect to:

Internap Network Services PNAP-06-2001 (NET-66-150-0-0-1)
66.150.0.0 - 66.151.255.255
Clickspring, LLC PNAP-BSN-CLKSPG-RM-01 (NET-66-150-193-96-1)
66.150.193.96 - 66.150.193.127

# ARIN WHOIS database, last updated 2004-02-08 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.

CustName: Clickspring, LLC
Address: 125 Chiswick Rd.
Address: Suite 110
City: Brighton
StateProv: MA
PostalCode: 02135
Country: US
RegDate: 2002-10-13
Updated: 2002-10-13

NetRange: 66.150.193.96 - 66.150.193.127
CIDR: 66.150.193.96/27
NetName: PNAP-BSN-CLKSPG-RM-01
NetHandle: NET-66-150-193-96-1
Parent: NET-66-150-0-0-1
NetType: Reassigned
Comment:
RegDate: 2002-10-13
Updated: 2002-10-13

TechHandle: INO3-ARIN
TechName: InterNap Network Operations Center
TechPhone: +1-206-256-9500
TechEmail: n...@internap.com

OrgAbuseHandle: IAC3-ARIN
OrgAbuseName: Internap Abuse Contact
OrgAbusePhone: +1-206-256-9500
OrgAbuseEmail: ab...@internap.com

OrgTechHandle: INO3-ARIN
OrgTechName: InterNap Network Operations Center
OrgTechPhone: +1-206-256-9500
OrgTechEmail: n...@internap.com

# ARIN WHOIS database, last updated 2004-02-08 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.Looks like
spyware to me!

Mike

unread,

Jun 2, 2004, 3:07:51 AM6/2/04

to

ClickSpring is also known as PurityScan. It is nothing but spyware. If you
have this on your system, then you should get rid of it. You may also find
a file or program called Psear1. Here is a link for more detailed info:
http://www.answersthatwork.com/Tasklist_pages/tasklist_w.htm
Scroll down to [Winservn]

If you don't have PurityScan, then here a a couple of more hits for
ClickSpring:
http://search.freefind.com/find.html?pageid=r&id=6940792&mode=ALL&n=0&query=clickspring

--Mike

"Gary" <spamfree*rgd...@carolina.rr.com> wrote in message
news:bbbvc.38$wH4....@twister.southeast.rr.com...

Gary

unread,

Jun 2, 2004, 9:09:39 AM6/2/04

to

Hey Mike, thanks for the links.

I went to the sites and found none of the files that it suggested that I
look for. It's interesting also, because I never used Purity Scan for
anything and it suggests that this is how you get their stuff on your
computer.

I don't know what that ucae file is exactly, since it isn't listed on those
sites and none of the associated files were present, but I was able to
remove it by terminating the process that was running and simply deleting
it. So far it has not come back. Everything seems to be running normally.

I'll keep the fingers crossed.

Thanks for the info!

Gary

"Mike" <ms...@execpc.com> wrote in message
news:w0fvc.20955$to.1...@twister.rdc-kc.rr.com...