Lacon (also known as Email-Worm.Win32.Lacon) Is a worm on Win32. It spreads via email, peer-to-peer, or mIRC.
When the file is executed, it sends an email with an attachment, the attachment file is called: "No Call List". The email reads:
Subject: National No Call Registry Info I just saw this on the local news. You can add yourself to this National No Call List so telemarketers stop calling. I just did it, its real easy. Just click the attachment to add yourself!
See you soon!
The program then creates a folder in Program Files, and adds copies of the attachment file with different names to that folder. The worm also drops files into the Windows folder as well. The worm also creates a text file, that reads:
The deed has been done. W32.HLLW.NoCall by DimenZion
If the worm is run on the tenth of any month, executing the worm will make a message that says:
Your Angry Computer All I do is work, work, work... I quit!
If the user presses "OK" the message will make the worm log off the user, and ends all the user's processes. Logging back in will display the message again, but this time, if the user presses "OK", there will be another message, saying that it cannot quit. Pressing "OK" again will still log the user off. The worm also changes the homepage on Internet Explorer, to a Flash video that resembles the "This page cannot be displayed" page, except that characters from Homestar Runner will appear on the page.