Virus/backdoor unknowned

Impossible to find a definition

[Maleville]

Hello everybody.

I got 2 virus/backdoor and I don't know what they are doing. I found answers on Goggle, in Deutsh, but even with a google-traduction it is incomprehensible.
One is BDS/DELF.KL.3 which infected P2ECOM.dll and the other is TR/Trilona.B.2 which infected netia.inf

Any idea?

[henry0]

Are you sure about name, spelling etc..
Trend Micro and even SERT do not know anything about it?

Can it be a new one?

How did you figure that you have a virus?

And is it a virus? Or some kind of other "plague"?

What are the symptoms?

Did you run:?
HiJackThis
And Spybot search hand destroy

[encyclo]

P2ECOM.dll

It could be a dialler - you know, the sort of program which changes your modem phone number to an overseas premium-rate line. If you're on dialup, then I'd disconnect and check the number!

What identified the virus in the first place? Your virus checker? Wasn't it able to clean up?

[Leosghost]

What are the file dates and the byte sizes on this ..Can you read the interior hex code of the suspected virii ..?

[deejay]

DELF is a very large family of backdoors - F-secure reports the latest variant as at April as delf.mv. No particular removal instructions though.

for searching on Google, just search for 'delf' or 'trilona' and use advanced search preferences to set the language to only return English results.

Delf information from symantec: [securityresponse.symantec.com...]

[Leosghost]

Just got finished reading the german stuff ( I don't read german so fast as English or French ) and came back saw that deejay had filled you in on the delf family ..the Tr series is basically also a trojan installer ..

there is a freetrial AV that you can get which should remove both as they are generic types at [centralcommand.com...]

dont know the company ..but the fact that they are offering AV for linux may interest some here

[Maleville]

Thank you for all of you.

For henry0, encyclo:
I am now sure of the name and spelling.
I found BDS/Delf.KI.3 and TR/Trilon.B.2 on my hard drive with my anti-virus AntiVir version 6. They were both in the library but AntiVir doesn't give an explanation on what they are and they do.
BUT as you see, when I was writting my post I did a mistake with names (shame on me!).
AntiVir said in its log:

"C:\WINDOWS\SYSTEM
P2ECOM.dll
[DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Delf.KI.3Backdoor server programs
WAS DELETED!"

"C:\WINDOWS\Downloaded Program Files netia32.inf [DETECTION] The Trojan horse TR/Trilon.B.2 WAS DELETED!"

Symptoms were supression of WordPad, impossibility to reach Outlook Express, Internet Explorer, CALC was replaced with an Hexadecimal type. I haven't tried to find others faults.
I tried Spybot search and destroy AFTER AntiVir erased both suspicious applications. No thing wrong.
I didn't try HiJackThis.

For Leosghost and deejay:
Unfortnatly, I prefered that AntiVir erased the files at the moment.
I checked Symantec. Nothing seems to be wrong in the Registry.

Now, all is under control. Thank you for suggestions and ideas you gave.