VBS.Bici (demo)

Printer Friendly Page

Discovered: November 05, 2001
Updated: February 13, 2007 11:53:20 AM


VBS.Bici (demo) is a demonstration worm.

Antivirus Protection Dates

  • Initial Rapid Release version November 05, 2001
  • Latest Rapid Release version September 28, 2010 revision 054
  • Initial Daily Certified version November 05, 2001
  • Latest Daily Certified version September 28, 2010 revision 036

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Writeup By: Neal Hindocha

Discovered: November 05, 2001
Updated: February 13, 2007 11:53:20 AM


The worm displays two messages and then sends out email messages. The messages clearly indicate what the worm is about to do. If you click Cancel at either of the message boxes, the worm will not send any email messages.

This worm works only on computers that have certain paths available. Most likely, it works only inside one specific company network.

Writeup By: Neal Hindocha

Discovered: November 05, 2001
Updated: February 13, 2007 11:53:20 AM


Run LiveUpdate to make sure that you have the most recent virus definitions.

  1. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
  2. Run a full system scan.
  3. Delete all files that are detected as VBS.Bici (demo).


Writeup By: Neal Hindocha