Another Flashy Virus First

Antivirus security vendor Sophos says it has discovered the first virus that infects Shockwave Flash files. The virus, SWF/LFM-926, can infect users who download and play Flash files, which are commonly used to jazz up Web sites and can appear in everything from splashy site introductions to how-it-works graphic demonstrations.

When a Flash movie file is played, the virus displays "Loading Flash Movie..." and infects other Flash files within the directory. During infection, the virus creates a 926-byte file, V.COM, that infects other Flash files, according to Sophos. The virus spreads only when a Flash file is manually downloaded and opened using the Shockwave player, Sophos says. Experts do not expect this virus to spread rapidly, and no reports of the virus spreading "in the wild" have been reported.

"This virus is clear proof that virus writers continue to search for new ways to infect computer users," says Graham Cluley, senior technology consultant for Sophos. Cluley believes this virus is a "concept virus"--one written to prove a virus would work. But it wouldn't be hard for copycat virus writers to add a destructive payload, he says. If the virus becomes capable of spreading via Web-site visitors viewing Flash files, its impact could be much more devastating.

This issue does not affect Web content viewed in a browser; according to Macromedia's testing, the virus can only affect content sent via E-mail or downloaded from a site and then run outside a browser. (Macromedia is providing additional information on the patch at its Web site.)

Cluley says Sophos received the virus from an anonymous E-mail account, probably sent by the virus writer.