New Virus Alert for Shockwave Files - and why doesn't InnoculateIT know about it???

[Nanceel0]

Hi,
I just got word of this new virus (low risk at the present time). Since I recently changed over to InoculateIT, I wonder why they don't have it listed??? And if they don't have it listed I have to assume anyone using InnoculateIT isn't protected? Maybe they'll list it tomorrow??
Sincerely, Nancee

Here's the information:

This new computer virus is a very low risk and it is not widespread in the industry yet. It primarily represents a new avenue of attack. For the first time Shockwave files that are often used for website animation can be infected by viruses. While the 1st version is a proof-of-concept virus, other variants could follow in the future.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Virus Alert: SWF.LFM.926

SWF/LMF_926 is a virus designed to infect Shockwave Flash files (SWF extension). This is an application mainly used to create animations for web pages. The virus uses the ActionScript scripting language supported by Shockwave Flash to create a DOS executable named V.COM on the system. This file is executed by the virus and performs the infection of other Shockwave Flash (SWF) files in the same directory. The most noticeable aspect of this virus is that it infects files that had been considered as "safe" in the past.

LINKS http://www.sophos.com/virusinfo/analyses/swflfm926.html http://www.symantec.com/avcenter/ven...f.lfm.926.html http://www.f-secure.com/v-descs/swflfm.shtml

[WhitPhil]

It will probably make their next update.

The "good" news is in the Sophos link..

"the virus can not jump from a web page to an end user machine during normal surfing. The only way it can succesfully spread is that the SWF file is downloaded manually, placed to a directory which contains clean SWF files and then executing the file with Shockwave Player."

[Nanceel0]

Hi Phil,
Thanks for pointing out that it can't jump from a web page during regular surfing. I feel a little better about that.
And I do notice that InoculateIT has very frequent updates. As a matter of fact, I just checked and I'm downloading 1751 dat file right now.
Sincerely, Nancee

[Interceptor1]

Hi, this is causing a bit of unneccessary panic among users.

First, this is aimed at webmasters that use flash movies when designing websites.

Second, through the steps mentioned above, it is possible for an end user to become infected by this virus.

Third, this infects only NT/2000 machines. By posting in this forum I assume you use Win98, so you don't have to worry about it.

Last, this has NOT been introduced into the wild. It went straight from the virus author to antivirus software vendors and Macromedia, so it does not represent a current threat. It merely shows another possibility that could be utilized by a malicious virus writer.

[This message has been edited by Interceptor1 (edited 01-10-2002).]

[This message has been edited by Interceptor1 (edited 01-10-2002).]