Virus writers find new victim

May 12, 1999 Sophos Press Release

Sophos identifies first Corel SCRIPT virus

Illustrators using Corel software are being threatened by the attack of a new virus. The virus is written in Corel SCRIPT, a macro programming language supported by Corel's products. Until now, Corel SCRIPT has been free from virus infection.

The virus, dubbed 'CSC/CSV-A', infects .CSC (Corel SCRIPT) files. Every time an infected script is run it looks for another victim file and infects it.

On 6 June, the virus displays part of a poem by famous writer J.R.R. Tolkien. The fantasy works of Tolkien have always been popular amongst the virus-writing counter culture.

"While this virus is more irritating than destructive, it is proof that virus writers are aggressively searching for new entry-points into the software market", said Paul Ducklin, head of research at Sophos."We can expect to see similar attacks on other relatively sheltered areas of the industry."

"Another interesting feature of this virus is the J.R.R. Tolkien poetry reference", he added. "Hobby connections in viruses may turn out to be useful to the authorities in investigating and prosecuting virus writers."