|Place of Origin|
|File Type(s)||.swf, .com*|
|Infection Length||926 bytes|
LFM is the first virus to infect Shockwave Flash files.
When an infected Shockwave Flash file is executed, LFM uses CMD.EXE to run the DEBUG.EXE program to create a file named V.COM in the folder it was executed from. It displays a DOS window with the words "Loading.Flash.Movie…". This 926 byte file is actually a DOS .com file that contains code for infecting .swf files. The virus executes V.COM, which infects other .swf files in the same folder.
LFM was entirely a proof-of-concept virus that was never intended to make it into the wild. While Shockwave Flash files are typically used for animated Internet content (games, videos, advertisements), it has no ability to spread by itself beyond the folder it is contained in. It did cause antivirus researchers to consider possibilities for this kind of virus, like having a malicious payload. In spite of their potential, Shockwave Flash threats have yet to catch on as of this writing.
Neal Hindocha. Norton Antivirus, ACTS.LFM.926. 2007.02.13
Sophos Antivirus, SWF/LFM-926.
McAfee Antivirus, SWF/LFM.926.
John Leyden. The Register, Flash gets its very own virus. 2002.01.08
マイコミジャーナル, Shockwave Flashに感染する初のウイルス「SWF/LFM.926」 - 危険度は「低」. 2001.01.09