GoHip

[Greg Hesla <ghesla@CIMACONSULTING.COM>]

All,

About a month ago, I posted a message to PeopleSoft Fans, and another
message to SQR Users. At the time, I didn't realize that I was also sending
an advertisement for this GoHip crap. Those of you who recognize the name
probably know what I'm talking about. For the rest of you, my only advice is
to NEVER to to their web site. My Internet Explorer settings were changed,
my home page was changed, and my signature had been changed to "Click here
for a free video" and had a link to a gohip url, which I will not reproduce
here. It seems I could not get rid of these settings, because every time I
rebooted my machine, they were back.  Once I realized what had happenned, I
searched high and low, and eventually found the ducoment I am attaching to
this e-mail. I followed the instructions, carefully, and am now GoHip free.
If you have been hit by this thing too, the attached file will probably be a
big help.

Note: The instructions involve changing stuff in the Windows Registry. If
you are not real comfortable doing this, find someone who is comfortble with
the Registry Editor to help.

I'd like to apologize to anyone who may have gotten this thing because of my
e-mails.

Greg
GoHip Uninstallation Instructions

Some of these instructions include editing the Windows Registry. 
Although the instructions are fairly detailed, be VERY careful 
when modifying the Windows Registry. ALL CHANGES ARE IMMEDIATE 
AND PERMANENT! THERE IS NO UNDO! Once something has been deleted 
from the Registry it is gone. The author of this document takes 
no responsibility for any consequences that may arise as a result 
of following the steps outlined in this document.

Now, to get rid of this nasty little virus, (I call this a virus 
because it does stuff without permission, and is very difficult to
remove), perform the following steps.

1) Delete the nasty little program responsible for adding those ugly
   GoHip settings to your Internet Explorer, Outlook Express, etc...
   a) Open Windows Explorer
   b) Navigate to the C:\Windows directory (or wherever your version 
      of Windows has been installed)
   c) Delete the file winstartup.exe
   
2) Delete the shortcut to the above program
   a) Right-click on the [Start] button, and select Explore from the 
      pop-up menu
   b) Navigate to Programs\StartUp
   c) Right-Click on the shortcut named "Windows Startup" and select 
      Properties from the pop-up menu
   d) Ensure that the Target is "C:\Windows\winstartup.exe RESCAN"
   e) Cancel the Properties dialog box, and delete this shortcut.
   
3) Restore your original Signature in Outlook or Outlook Express. I
   have included detailed instructions for Outlook Express because that
   is what I have. The steps should be somewhat similar for Outlook.
   a) Open Outlook Express
   b) From the menu, select Tools, Options...
   c) Click on the Signatures tab
   d) Either delete the signature named "Signature #1" (the one with 
      the advertisement for a free video from www.gohip.com) or change 
      it to whatever you want your signature to be.
      
4) Restore your Start Page
   a) Open Internet Explorer
   b) Go to whatever internet address you would like as your start page
   c) Select from the menu Tools, Internet Options...
   d) In the Home Page section at the top, click on the [Use Current] button.
   
5) Delete favorites that may have been added by our little virus friend
   a) Open Internet Explorer
   b) Select from the menu Favorites, Organize Favorites...
   c) In the resulting window, scroll down and find the following shortcuts.
      When/if you find them, click on the [Delete] button to get rid of them.
      The shortcuts to delete are:
         Free E-Mail
         Free Hosting
         Free Stuff
         Free Travel
         Free Video

6) Modify the affected Registry settings. Again, take great care when 
   performing these steps, as any changes you make are IMMEDIATE and PERMANENT.
   a) Open the Registry Editor.
      a1) Click on the [Start] button, and select Run...
      a2) In the Run dialog box, in the Open Text box, type "regedit" (without 
          the quotes) and click the [OK] button.
   b) In the Registry Editor, which uses an Explorer-like interface, navigate to 
      My Computer\HKEY_CURRENT_USER\Software\GoHip. This is where the settings 
      for GoHip are stored. The items that look like folders on the left side 
      of the screen are called Keys.
   c) With the GoHip "Key" selected press the Delete key to delete it. A 
      confirmation dialog will be displayed. MAKE SURE that the GoHip Key is the 
      one that is being deleted, and click [OK] to delete the key.
   d) Now, navigate to 
      My Computer\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
   e) On the right side of the Registry Editor screen, you will see many entries. 
      Look for an entry named "Search Bar". You will see that the value that 
      this contains is something about GoHip. Double-click on the words "Search Bar"
      and a dialog box will display showing the contents of this String Value. 
      Delete the contents only if it contains gohip, or a url containing gohip. 
      When you have deleted the contents of this string value, click [OK] to close
      the dialog box.
   f) Repeat the process above for the String Value named "Search Page". Double-click
      on "Search Page", delete its contents, and click [OK] to close the dialog box.
   g) Navigate to 
      My Computer\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl
      Delete this key the same way you deleted the GoHip key in step 6.c.
      
Your PC should now be free of GoHip. If your version of Internet Explorer supports it, 
you may want to add www.gohip.com to the list of restricted sites. This way, you won't 
even accidentally go back there and get stuck in this mess all over again.