Can't locate unknown process

[Brenda M]

I was looking at the list of processes currently running and I noticed
something called "lucoms~2.exe". I then searched my hard drive hoping
to locate it and thus identify the ID of its creator. However, the
only file I found was in the prefetch folder.

Since it is in the prefetch folder and the process is definitely
running, how come I can't find it?

Thanks.

Brenda

 

[Will Denny]

Hi Brenda

Please try the following programs to search for any spyware that may be on
your system:

Ad-Aware - www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://forum.aumha.org/downloads/cwshredder.zip
Spy Sweeper - www.webroot.com

Try SpyWareBlaster to stop intrusions:

http://www.javacoolsoftware.com/spywareblaster.html

Also see the following links:

http://aumha.org/a/parasite.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.microsoft.com/security/articles/spyware.asp

 

[Richard Urban]

You had a Norton/Symantec product on your computer - and then removed it? It
is the LiveUpdate Engine COM Module - from Norton.

This is a holdover from when it was there. You can now delete the entry from
the prefetch folder if it is no longer needed.

--
Regards,

Richard Urban

aka Crusty (-: Old B@stard

If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Li'l Roberto]

Brenda
If you are running symantec Anti Virus software lucoms~ [aka live
update com] is part of the package leave it be.
rgds
Li'l Roberto

 

[R. McCarty]

If' it's running, have you checked Add/Remove programs in Control
Panel. Many times removing a Symantec product will not remove the
Live Update and LiveReg components. If either or both do not show
up in the listing, you've probably got a case of "Orphaned" processes
& Services that will need to be removed manually or with Symantec's
RNav,RNis or SymCln (Depending on which product you had).

 

[Richard Urban]

Also, lucoms~2.exe is the DOS 8.3 way of naming a file that is longer than
the 8 characters allowed prior to the file extension.

Thus, LuComServer_2_6 becomes LuComS~1.

The other similar Norton file in the same folder, LuComServerPS_2_6.DLL
would be LuComS~2 - to differentiate it from the former.

--
Regards,

Richard Urban

aka Crusty (-: Old B@stard

If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Drew Tognola]

Brenda,

When you search do you have the 'Advanced Options' boxes checked?

Drew

I was looking at the list of processes currently running and I noticed
something called "lucoms~2.exe". I then searched my hard drive hoping
to locate it and thus identify the ID of its creator. However, the
only file I found was in the prefetch folder.

Since it is in the prefetch folder and the process is definitely
running, how come I can't find it?

Thanks.

Brenda

 

[Richard Urban]

Guess I'm tired and should NOT have typed the last sentence as it is
incorrect.

LuComServerPS_2_6.exe = LuComS~1.exe
LuComServerPS_39_6.exe = LuComS~2.exe (hypothetical file)

If - If - there were a file (there isn't) that was named
LuComServerPS_39_6.exe, it would have the DOS filename of LuComS~2.exe as
the first 6 characters are always used along with the ~ and a number, to
show that it is, in fact, a different file.

Did I get it right this time (-:

--
Regards,

Richard Urban

aka Crusty (-: Old B@stard

If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[R. McCarty]

Good point - Do we know if the poster still has Symantec products
installed on their system ? I realized that after I suggested taking out
Live Update and LiveReg from Add/Remove programs.

 

[Richard Urban]

Until the poster gets back to us, we won't know (-:

--
Regards,

Richard Urban

aka Crusty (-: Old B@stard

If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Brenda M]

Thanks for the explanation. I do have NAV installed on my computer and
I can see the LuCom* files inside the "Symantec/LiveUpdate" folder. I
just wanted to make sure it wasn't a spyware.

I have a sort of related question. Using Windows Explorer, I am
looking at the "Symantec" folder and it has one subfolder "LiveUpdate"
and 4 visible files. When I click on the folder properties, it says it
has one subfolder and *33* files. In the "View" tab of "Folder
Options", I have selected to show hidden files and folder and display
the contents of system folders, and I have unchecked the box for
hiding protected operating system files. Why can't I see the invisible
files? I am sure the invisible files are legit but I am a bit annoyed
that I am not allowed to see files on *my* computer. You may remember
that in an earlier posting I tried unsuccessfully to reveal the
invisible files in the "Temporary Internet Files" folder.

Thanks.

Brenda