CorelDRAW Mac CDs carried AutoStart worm

In October 1998, Corel recalled the second pressing of CorelDRAW 8.0 for Mac OS. Virus Bulletin reported that the affected CD-ROMs carried the D strain of AutoStart 9805 and that Corel said it had retrieved 95% of the infected discs during the first week of October.

The delivery path was plain physical distribution. A user mounted a trusted Corel CD-ROM on a PowerPC Mac with QuickTime AutoStart enabled. The QuickTime extension, version 2.0 and later, could then launch an application from the volume before the user made a security decision. The behaviour was gated on a single Enable CD-ROM AutoPlay setting, and before QuickTime 2.5 that setting could not be turned off at all.

AutoStart 9805 lived in removable media and the classic Mac OS Extensions path. The D strain dropped an invisible DELDB file on the media and a hidden DELDesktop Print Spooler extension on the host, then copied itself to other mounted HFS or HFS+ volumes. Only the original A variant used the plain DB and Desktop Print Spooler names. This strain was less destructive than the original line, but the carrier was official product media.

Corel responded by recalling the affected batch and issuing public guidance. The incident belongs with the older physical-media failures: the package was authentic, the label was trusted, and the bytes on the disc were not clean.