Type File virus
Date Discovered 2002.01.08
Place of Origin
Source Language ActionScript
Platform Shockwave Flash
File Type(s) .swf, .com*
Infection Length 926 bytes
Reported Costs

LFM is the first virus to infect Shockwave Flash files.


When an infected Shockwave Flash file is executed, LFM uses CMD.EXE to run the DEBUG.EXE program to create a file named V.COM in the folder it was executed from. It displays a DOS window with the words "Loading.Flash.Movie…". This 926 byte file is actually a DOS .com file that contains code for infecting .swf files. The virus executes V.COM, which infects other .swf files in the same folder.


LFM was entirely a proof-of-concept virus that was never intended to make it into the wild. While Shockwave Flash files are typically used for animated Internet content (games, videos, advertisements), it has no ability to spread by itself beyond the folder it is contained in. It did cause antivirus researchers to consider possibilities for this kind of virus, like having a malicious payload. In spite of their potential, Shockwave Flash threats have yet to catch on as of this writing.


Neal Hindocha. Norton Antivirus, ACTS.LFM.926. 2007.02.13

Sophos Antivirus, SWF/LFM-926.

McAfee Antivirus, SWF/LFM.926.

John Leyden. The Register, Flash gets its very own virus. 2002.01.08

マイコミジャーナル, Shockwave Flashに感染する初のウイルス「SWF/LFM.926」 - 危険度は「低」. 2001.01.09

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License