1. Click on 'Start' followed by 'All Programs,' 'Accessories,' 'System Tools' and 'System Restore.' Once the 'System Restore' box pops up, click on the 'System Restore Settings' link. Click on the 'Turn off System Restore' box on the 'System Restore' tab to uncheck it.
2. Restart your computer. Once it is booting back up, repeatedly press the 'F8' key to reach the system boot menu. Choose to boot in 'Safe Mode' by using the down arrows on the keypad to cycle down to the option, and then press 'Enter' to select it.
3. Navigate to 'C:\Program Files' or 'C:\windows\system32' folder to find any 'ShoppingBHO.dll' programs. The file may also be located under '%%ProfileFolder%%application datafcsb000062035toolbarshoppingbho.dll.' The file sizes of the shoppingbho.dll programs are 630,272 bytes , 638,976 bytes, 615,936 bytes, 646,144 bytes or 614,400 bytes. The 'Shopping.BHO.dll' files also have a specific id of 20FEC4E7-F7B7-438B-8191-33D2EFC5EBEA, 998A3C0C-8914-4D2A-AE36-BFA2E5AE6D5D or 91917DC6-93B9-4E62-B2D6-D39C9618C418.
4. Click on 'Start' followed by 'Run.' Type in 'regedit,' and then press 'Enter.' Once the registry editor opens, browse through the 'HKEY_LOCAL_MACHINE\SAM,' 'HKEY_LOCAL_MACHINE\, HKEY_LOCAL_MACHINE\,' 'HKEY_LOCAL_MACHINE\, HKEY_CURRENT_CONFIG' and 'HKEY_USERS\DEFAULT' directories by clicking on the '+' icon next to the folders to extend the directories. Delete any 'ShoppingBHO.dll' registry entries by clicking on the 'ShoppingBHO.dll' file to select it. Right-click and then click on 'Delete' to remove any 'ShoppingBHO.dll' registry entries. Once you are done, close the registry editor and reboot your computer in normal mode.
5. Look through the directories on your computer. Delete any files or programs that have been infected by the 'ShoppingBHO.dll' file. Remove the programs by deleting them or by using the 'Add or Remove Programs' feature.
6. Open your Internet browser, and delete all of your temporary Internet files, browsing data, cache and any other browsing files. The 'ShoppingBHO.dll' file is now removed from your computer.
Read more ►