From: "Geo." 

it's an irc based virus,
http://www.sophos.com/virusinfo/analyses/mircwormgdog.html

Geo.

"David Blair"  wrote in message
news:3f16f6d1{at}w3.nls.net...
> I did a cut and paste directly from the browser. Of course, I edited the
> direct page itself, editing from the host name.
>
> I've had a more pressing problem hit me today- despite my virus and dual
> firewall protections, I've gotten hit with either a worm or virus that had
> bitten my email.
>
> I've got yet a 3rd anti-virus to run over my machine (it is a problem that
I
> had at a previous job as well, but there I was more vulnerable because we
> have to many fooking idiots who would bring in all manner of crapola and
it
> would occasionally end up in MY inbasket.) Here, I know when it happened-
> and it ticks me off, because the site it came from should have been
secured.
> Someone has some unpleasant email coming. I watched as my machine got hit
> and turned it off, but apparently this  was a residual problem. I'm
running
> a new antivirus to see what McAfee and Norton missed.
>
> Anyone know what to do with this damned GDOG GDOG GDOG thing?
>
> "John Beckett" 
wrote in message
> news:3f1668d2.17352050{at}216.144.1.254...
> > "David Blair"  wrote in message
> > news::
> > > Somehow, having the URL in my HOSTS table as usual isn't working.
> >
> > I guess you're just speaking loosely, and you've put the host name in
the
> > HOSTS file? First step is to see if you have made a typo. Copy the host
> > name from the URL, then go to a command prompt window and type
> > ping
> > then right-click the command prompt window to paste the host name. Press
> > Enter to see if your computer trys to ping the IP that you have in HOSTS
> > (you don't care if the pings work or not, you just want to see what IP
it
> > uses).
> >
> > Another simple test is to change the IP in your HOSTS and repeat the
above
> > (you might need 'ipconfig /flushdns' first). This should at least prove
> > that your HOSTS is working.
> >
> > If you are being sent to an IP address, you could try fiddling with your
> > routing table. I haven't seen the effect on a browser, but it should
work.
> > Say the site is 11.22.33.44. You could run the following at command
> > prompt:
> >
> > route add 11.22.33.44 mask 255.255.255.255 127.0.01
> >
> > If this works, it will last until next boot. Put -p after 'route' to
make
> > the command persistent.
> >
> > John
> >
>
>

--- BBBS/NT v4.01 Flag-4