How To Remove The Halflemon.com Search Redirector

This self-help guide will allow you to remove the Halflemon.com search redirector

What this program does: Redirects Internet Explorer searches to http://www.halflemon.com/search.html Tools Needed for this fix:

• HijackThis
  

Related Tutorials:

• How to use HijackThis to remove Browser Hijackers & Spyware
  

Symptoms in a HijackThis Log (Maybe different entries but will contain the same domains and hostnames):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.halflemon.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.halflemon.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.halflemon.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {D94AAA2A-C415-42E3-82B6-49FAB4EBFFE9} - C:\PROGRA~1\HALFLE~1\HALFLE~1.DLL
O16 - DPF: {D94AAA2A-C415-42E3-82B6-49FAB4EBFFE9} (SearchHook Class) - http://www.halflemon.com/Halflemon.cab

---

Removal Instructions:

1. Connect to the Internet and stay connected throughout this entire removal process.
   
   
2. Download HijackThis from the above link and extract it to c:\hijackthis.
   
   
3. Navigate to the c:\hijackthis directory and double-click on HijackThis
   
   
4. When the program starts, double-click on the HijackThis icon and then click on the Scan button.
   
   
5. Put a checkmark next to the following entries if they exist:
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.halflemon.com/search.html
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.halflemon.com/search.html
   R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.halflemon.com/search.html
   R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
   R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
   R3 - URLSearchHook: SearchHook Class - {D94AAA2A-C415-42E3-82B6-49FAB4EBFFE9} - C:\PROGRA~1\HALFLE~1\HALFLE~1.DLL
   O16 - DPF: {D94AAA2A-C415-42E3-82B6-49FAB4EBFFE9} (SearchHook Class) - http://www.halflemon.com/Halflemon.cab
   
6. Then click the Fix button
   
7. Exit HijackThis.
   
8. Reboot your computer.
   
9. Delete the following directories if they exist:
   
   c:\program files\halflemon
   
10. Reboot your computer and let it boot normally.
    

Now your computer should no longer be infected with the Halflemon.com redirector. It may be possible that you still have some spyware or malware installed on your computer. If you feel this is the case, follow the instructions below to post a HijackThis log and someone will help you to remove the rest.  

---

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can post a HijackThis log in our HijackThis Logs and Analysis forum.

If you have any questions about this self-help guide then please post those questions in our AntiVirus, Firewall and Privacy Products and Protection Methods forum and someone will help you.