Funcionapage.com Removal Guide

We want to inform you about a newly discovered browser hijacker called Funcionapage.com that can enter your computer without your authorization or knowledge, so you have to remove it as soon as you can. In addition to replacing your web browser’s search-relates settings, this hijacker will collect non-personally identifiable information about you and your browsing habits and promote websites that may be of unreliable nature. This newest infection is not unique by any measure because it has multiple clones and the purpose of all of them is to generate as much advertising revenue as possible, even if it means putting your computer’s security in jeopardy. Please continue reading to get more information about it.

Let us begin our analysis with this hijacker’s origins. This hijacker belongs to a browser hijacker family known as Elex. It is a largely unknown malware developer responsible for releasing hijackers that include Ooxxsearch.com, Maniihome.com, and Amisites.com. In addition, we want to mention that this company has also released a potentially unwanted program named AdSkip. So it is evident that Funcionapage.com comes from an unreliable background, a company that is in the business of generating advertising revenue from injecting promotional links in the search results of fake search engines such as Funcionapage.com. Unfortunately, there is no right answer for avoiding this hijacker from entering your PC.

Since it is a relatively new release, we have yet to find a sample of this hijacker’s carrier. Nevertheless, we have received information suggesting that it might come bundled with a program called Picexa. We assume that both Picexa and Funcionapage.com come in a malicious installer that injects this hijacker into the browser without your knowledge or approval. Hence, it does not have a dedicated browser extension and is injected directly by the malicious software installer. So there is some information suggesting its distribution methods, but at this stage nothing is concrete.

Our research suggests that this hijacker should be compatible with Internet Explorer, Chrome, and Firefox because its clones were compatible with these web browsers. In most cases, it should hijack settings such as the homepage and new tab page, but in some cases, it might also replace the search provider settings. Again, since we do not have a sample of its carrier, we cannot say for certain how this hijacker will affect the browser. In any case, once it has hijacked the homepage and you start using it for processing your search queries it should include additional search results in its search results. Funcionapage.com redirects all search queries to Google.com, but it is entirely possible for it to connect to a server that gives additional commands for showing promotional links. We base our assumption on the fact that this particular browser hijacker is hosted on the same IP address (104.25.216.18) that also hosts YesSearches.com.

As mentioned in the introduction, this hijacker can collect non-personal information about you and your browsing habits. Now let us take a look at what exactly it is capable of collecting. According to its Privacy Policy, it may gather information such as “internet protocol (IP) addresses, browser user agent, referring page, date/time stamp and cookies and web beacons automatically.” The document also claims that this information is used for analyzing trends, gather demographic information and so on to provide better services. It seems that by “services” they mean advertisements of which you should find in abundance in the search results. Unfortunately, not all of the promoted content is safe and based on the research of its clones we think that it is capable of showing you links to shady and outright malicious websites. Therefore, we recommend that you delete this hijacker.

The removal process should be similar if not the same as its clones, so we have composed a step-by-step guide that should be helpful to you. Our guide shows how to replace the search-related settings manually. However, you can try replacing the homepage, new tab page, and search provider from the browser settings. You can also try resetting the browser’s settings to its default settings, but if that does not work, then consult this guide below.

Manual Removal

Microsoft Internet Explorer

1. Press Windows+R.
2. Enter regedit in the dialog box.
3. Click OK.
4. In the Registry Editor, go to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
5. Locate Start Page and right-click it.
6. Select Modify.
7. Replace http://funcionapage.com with your desired homepage address.

Mozilla Firefox

1. Press Windows+E.
2. In the address bar, enter C:\Users\{user name}\AppData\Roaming\Mozilla\Firefox\Profiles\{Random ID}
3. Find prefs.js and right-click it.
4. Open it with Notepad.
5. Replace http://funcionapage.com in user_pref("browser.startup.homepage", " http://funcionapage.com"); with your desired homepage address.
6. Save and Close.

Google Chrome

1. Press Windows+E.
2. In the address bar, enter C:\Users\{user name}\AppData\Local\Google\Chrome\User Data\Default
3. Find Preferences, Secure Preferences and Web Data files.
4. Right-click these files and open them with Notepad.
5. Replace all strings featuring http://funcionapage.com with your desired homepage address.