LUCOM~1.EXE running as a process in Task Manger

Viruses and worms
1

Searched here and can’t find it: http://systemexplorer.net/

Also, http://process.iamnotageek.com/LUCOMS~1.EXE.php

Did have NIS on this system quite some time ago, still have Norton Ghost v 10.

Searched system and no go for this or variations: lucoms.exe or lucoms1.exe. As it is a process, from where does it originate?

Google gives this: https://www.google.com/#gs_rn=19&gs_ri=psy-ab&cp=5&gs_id=4u&xhr=t&q=LUCOMs+1.exe&es_nrs=true&pf=p&output=search&sclient=psy-ab&oq=LUCOM&gs_l=&pbx=1&bav=on.2,or.r_qf.&bvm=bv.48705608,d.aWc&fp=108a93c58fa57954&biw=1152&bih=703

Malwarebytes gives nada. Avast! nada.

As I know the drill, should I submit required analysis programs now or later on as other users weigh in?

System does not show operating anomalies of any kind, even when this process is terminated via TM. It does not initiate with boot, but comes in ten minutes or so later. Possible this happens when internet connection is made here.

Running AdwCleaner now and will post that in next reply.

Operating system is listed below in my sig.

Depending on replies made here, will I have to remove from prefetch folder or? I’ve seen it there.

[EDIT:] Process name is wrong. It is LUCOMS~1.EXE

2

Three logs attached below:

Third one found on root of C: drive.

3
As I know the drill, should I submit required analysis programs now or later on as other users weigh in?
well you know essex.... he likes to have OTL to look at. ;)
4

I believe that is the Norton update file

5

Well, I’ve got the files you need to see and view below.

As I’ve got an older version of Norton Ghost, and PSI version 2.0.0.3003 was complaining that this program was end-of-life, I simply renamed the file detected by PSI by affixing .old to it and left it in original place and directory. This file was a part of the Live Update process, but as Norton stopped supporting and updating this software years ago, and it was the only real option then to rectify a reported security vulnerability by Secunia.

This system is almost ten years old, and MS support is ending soon, so next option will be to maybe run some version of Linux on it anyway, for as long as it continues to cold boot and run.

Even caught an extra txt file from OTL even though this system has been looked over before.

@essexboy: You did mention at that time that there were several symantec drivers running on this system; I don’t wish to remove any needed by Ghost to run properly tho. Removing the updater should/could be ok.

Will be watching this topic, but might be behind a day at times. BTW, system cold boots to desktop in XP using remanufactured IDE drives in 2:00 minutes, stock system settings, not too shabby.

I’ve got that LUCOMS~1.EXE process running now in TM, just so you know.

6

The Norton files are for Ghost and shared files, so no sense in removing those

Are you having any problems ?

7

Yes.

Two days ago, NG would open normally and run. I’ve set it to incremental backup once every 24 hours, but as it now opens with the Windows Installer first when opened manually, I’ve not allowed that to complete until I understand what is going on. Incremental backup is prevented by not having the system running at the scheduled time.

Clicking ‘Cancel’ 3x will bring up the normal gui, but going to any other link inside such as restore, backup, or other will start the Windows installer all over again. Here, ‘Cancel’ is needed only 1x to drill down to wanted feature.

Seems odd that this is doing this at this time. Cannot run WI in standard mode anyway, must be in admin. LUCOMS~1.EXE always seems to appear/spawn first in standard user, then log-off, log-on to admin will cause it to appear there. In either case, killing the process will end it, and it does not respawn again.

Any recommendations?

8

Remove it as there is no longer use of it, re: http://process.iamnotageek.com/LUCOMS~1.EXE.php
at least don’t let the updater run in Task Manager, use …http://www.majorgeeks.com/files/details/orange_lamp_software_killprocess.html
http://searchtasks.answersthatwork.com/tasklist.php?File=Lucoms~1
http://searchtasks.answersthatwork.com/tasklist.php?File

polonus

9

pol,

Just discovered Open DNS is reporting \CRANBERRY is a domain? How can that be, as I’ve not set it as such? An explanation as to what a domain could be in this context would be helpful here.

Running NETGEAR USB wireless only on \CRANBERRY, Qwest Q1000 DSL modem. Have PnP set to disabled. Also am seeing activity on Wifi when \CRANBERRY is at first connected and then after it is disconnected after cold boot of modem, but not when modem is first cold-boot and \CRANBERRY is not connected for the first time. WiFi light shows no activity in the former case until \CRANBERRY is connected for the first time.

In other words, \CRANBERRY is not on the network when the former situation applies, yet there is still activity on Wifi, after \CRANBERRY is disconnected and \CRANBERRY is now off the network. Who/what has access to the Wifi network then?

10

pol,

Many thanks for the help. ;D I’ve addressed the topic issue of LUCOMS~1.EXE running in task manager, it is now no more.

However, as networking issues are neophyte areas for me, how to address the domain issue reported by OpenDNS?

Any guidance here will be most appreciated.

Is it the wireless/modem or is it a setting I need to look for on this old and ancient but faithful horse? What, exactly, could it mean that the XP system is a domain as noted by OpenDNS? in it’s database report?

Due to system’s age, and upcoming end-of-life, do not wish to resort to purchasing a new disk imaging program because of issues noted here. Hope it is OK to proceed in that direction because of that.