W32.Toal.A@mm

W32.Toal.A@mm is a mass-mailing email worm. The worm arrives as an attachment named Binladen_brasil.exe with a random subject line that makes a reference to the current situation in Afghanistan. The subject can be in a variety of different languages. The message body will be blank.

The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message. Information on this, and a patch for the vulnerability can be found at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp.

The worm creates Invictus.dll, which contains routines to infect executable files on the system and network drives. The worm also creates an open share on drive C.

This worm uses the file Invictus.dll to spread. Invictus.dll is detected by Norton AntiVirus as W32.Invictus.dll. This file is crucial to the propagation of the worm, and the worm may not function properly without it.