HalfLemon
HalfLemon is a virus threat that appears in misleading security alerts generated by the rogue anti-spyware application known as Windows Antivirus Pro. The HalfLemon pop-up messages read as follows:
"Windows Antivirus Pro Alert. Infiltration Alert: Your computer is being attacked by an Internet Virus. It could be a password-stealing attack, a trojan-dropped or similar. Details: Attack from: 239.80.11.105, port 58962; Attacked port: 41567; Threat: HalfLemon, Do you want Windows Antivirus Pro to block this attack?"
Do not be fooled by these fraudulent warning notifications. These tactics are there to ensure the user purchases and downloads the fake spyware remover Windows Antivirus Pro.
Table of Contents
Author url of HalfLemon:
- halflemon.com
File System Details
HalfLemon may create the following file(s):
| # | File Name |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|
| 1. | %ProgramFiles%\Halflemon\halflemon.dll | |
| 2. | halflemon.exe | |
| 3. | halflemon.inf |
Registry Details
HalfLemon may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Halflemon.SearchHook.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{270514AB-6A3E-4DF8-9173-F240A0948251}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Halflemon.SearchHook
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0A4B13C3-CAF8-4DE1-BC09-48727433DD3A}
HKEY_CURRENT_USER\Software\Halflemon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D94AAA2A-C415-42E3-82B6-49FAB4EBFFE9}
