Malicious file
Configuration Utility.exe: is it the Lacon worm?
Configuration Utility.exe is an executable with a very generic name. A harmless program can use it, but the W32.HLLW.Lacon worm of 2003 is documented as using it too. The worm shows an “Angry Computer” message on the 10th of a month. Judge the file by its folder, signature and symptoms.
Prefer to do it yourself? The manual steps follow.
The name alone does not prove infection, but it is a known worm file name. If the file sits outside a program's own folder, is unsigned, or you saw the “Angry Computer” message, treat it as malware and remove it.
Some legitimate programs ship a settings tool with this generic name. If it is signed, sits in a program folder you installed on purpose and nothing else is wrong, it is probably that program's own file.
- Type
- Executable (.exe); in the malware case, a mass-mailing worm
- Threat name
- W32.HLLW.Lacon (also written W32/Lacon-A)
- First seen
- Late August 2003, according to a malware historian's write-up
- Spreads by
- Email to Windows Address Book contacts, peer-to-peer networks and pirated software sites, mIRC and other chat platforms
- Visible effect
- On the 10th day of a month a pop-up reads “Your Angry Computer. All I do is work, work, work… I quit!”, and Windows is logged off
- Other changes
- Browser home page changed to a Homestar Runner animation; copies of itself with lure names such as “AIM Password Hack.exe”
- Harmless uses
- The name is generic, so unrelated programs may use it for their own settings tool
What Configuration Utility.exe can be
Configuration Utility.exe is an executable that may run as a background process visible in Task Manager. Its name is a broad term, so it can be a part of many different programs, and some of them can be malicious. A correct verdict needs a check of the individual file.
The file is named as one that the W32.HLLW.Lacon worm installs and uses. Lacon appeared in 2003, targeted Windows, and e-mailed itself to contacts in the Windows Address Book with lures such as “1,000 Porn Site Passwords.exe”, “DeskTop Stripper – HOT!.exe” and “AIM Password Hack.exe”. It changed the browser home page to a Homestar Runner animation, copied executables into several folders and set registry values to survive a restart.
Once executed, the worm shows a message on the 10th day of every month: “Your Angry Computer. All I do is work, work, work… I quit!” After the pop-up it logs the user off.
Worms are dangerous because they spread on their own to other machines and files, without the user starting each copy. Cases where the file is simply an essential or harmless program's file are rarer than the name suggests, but they exist, so examine the process before deleting or keeping it.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How it arrives
In 2003 Lacon spread mainly as an email attachment with an executable file and a misleading subject line. Phishing with attachments is catalogued by MITRE ATT&CK as T1566.
Other channels documented for this worm and its kind:
Peer-to-peer networks and pirated program websites.
Malicious spam email attachments and hyperlinks.
mIRC and other chat platforms.
How to find it
A running process can show the file; folders and startup show where it came from.
- Look at the process in Task Manager Press Ctrl + Shift + Esc, open the Details tab, find Configuration Utility.exe, right-click it and choose Open file location. Note the folder.
- Search for the file Look for other copies and for lure names in Downloads, Desktop and Temp.
dir /s /b C:\*Configuration*Utility*.exe - Check the signature Right-click the file, choose Properties > Digital Signatures. A valid signature from a company that matches an installed program points to a harmless file; no signature in a user or Temp folder does not.
- Check startup Open Task Manager > Startup apps, or Autoruns or Process Explorer from Microsoft Sysinternals, and see whether the file starts at sign-in.
- Scan with Microsoft Defender Run a full scan, then an offline scan from Windows Security > Virus & threat protection > Scan options. Defender says whether the file is detected.
The name is generic, so a match on the name alone proves nothing. A valid signature and a program folder you recognise outweigh it.
How to remove it
Do this only if the file matches the signs above: wrong folder, no signature, the Angry Computer message, or a Defender detection.
- Disconnect from the network Turn off Wi-Fi or unplug the cable so the worm cannot send email or spread, then continue.
- Run a full Microsoft Defender scan Open Windows Security > Virus & threat protection > Scan options, choose Full scan and remove everything it reports.
- Run Microsoft Defender Offline scan In the same list choose Microsoft Defender Offline scan. The PC restarts and scans before Windows loads.
- Remove startup entries and leftovers In Autoruns or Task Manager > Startup apps, disable entries that point to the file, then delete the file and any lure-named copies and empty the Recycle Bin.
- Reset the browser home page Set the home page back in your browser settings; the worm changed it in 2003 to a Homestar Runner page.
- Repair system files Run the commands below in an administrator Command Prompt.
sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth - Tell your contacts The worm sent itself to Address Book contacts. If you sent suspicious attachments, warn the people you emailed.
Warning signs
| What you see | What it means |
|---|---|
| A pop-up “Your Angry Computer … I quit!” on the 10th | The documented Lacon payload; Windows is then logged off. |
| File in Temp, Downloads or Windows folder, not in a program folder | A real program's tool lives in its own installation folder. |
| No digital signature | A genuine commercial tool is normally signed. |
| Lure-named programs such as “AIM Password Hack.exe” | Copies the worm made of itself. |
| Browser home page changed to an animation | Lacon changed it to a Homestar Runner page. |
| Contacts receive attachments you did not send | Mass-mailing behaviour of the worm. |
Questions people ask
Is Configuration Utility.exe a virus?
Not always. The name is generic and some programs use it, but it is also documented as a file of the W32.HLLW.Lacon worm. Decide by the folder it is in, its digital signature and whether you saw the Angry Computer message. A full Microsoft Defender scan gives a second opinion on that exact file.
What is the “Your Angry Computer” message?
It is the payload of the Lacon worm. On the 10th day of every month the infected PC shows “Your Angry Computer. All I do is work, work, work… I quit!” and logs the user off. If you have seen this message, do not delay removing the malware from the device.
How does the Lacon worm spread?
It spreads by email to Windows Address Book contacts, peer-to-peer networks, pirated program websites, malicious attachments and links, and chat platforms such as mIRC. A worm does not need the user to open each target file to infect programs or system files, which is why it can be harmful even on a quiet PC.
Can I just delete Configuration Utility.exe?
Check first. If it belongs to an installed program, deleting it can break that program's settings tool. If it is the worm, deleting one file is not enough, because the worm made copies and startup entries. Run the full and offline Microsoft Defender scans and look at startup entries after the check.
Why is Configuration Utility.exe in Task Manager?
It can be a background process of a harmless program or of the worm. Open its file location from the Details tab. A signed file in a program folder you installed is usually that program's own; an unsigned file in Temp or a user folder is a reason to scan and remove it.
Does a Defender scan clean it completely?
Microsoft Defender removes the files it detects, but changes can remain. Check the browser home page, startup entries and system files, and run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth if Windows still behaves oddly.
Sources
- Vice: the W32/Lacon-A worm, its files, home page change and Angry Computer pop-up
- MITRE ATT&CK T1566 Phishing
- Microsoft Learn: Process Explorer
Version data read on Oct 5, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…