Behavior analysis: The virus spreads through MSN, disguised as a photo archive sent to contacts on MSN, enticing the contact to receive and open the virus. The virus achieves auto-start by loading through ShellServiceObjectDelayLoad. After running, the virus generates a ZIP archive file containing a copy of itself in the system directory.