I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Newest
Most helpful Newest Oldest
  1. bhringer-9380 4,350 Reputation points Volunteer Moderator
    2018-03-01T05:01:37+00:00

    IMO anything Trump may lead to a "honey POTUS" of undesirable activity.

    #notme ;-)

    ~bhringer

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2018-03-01T04:41:49+00:00

    I’ve reproduced the search engine issue on a couple of other PCs by just searching for “Trojan:JS/Flafisi.D”. Is this SEO poisoning gone crazy, or is there maybe a deeper issue here (it’s almost as bad as the local search engine issue). This is all too much extra work if I can’t find a usable search engine, so I’m inclined to just sit back and let things run their course. This issue definitely seems to be a parallel with the Yahoo issue, since these attacks are clearly site-specific – but then again, it’s hard to prove that there’s a general issue when the attacks are so sporadic. Tomorrow I’ll see if I can reproduce the detection/scam on a second machine, and maybe run some more scans on this one. So thanks for that tip, bhringer.

    GreginMich

    Was this answer helpful?

    7 people found this answer helpful.
    0 comments
  3. bhringer-9380 4,350 Reputation points Volunteer Moderator
    2018-03-01T03:52:06+00:00

    Ever tried ZHPCleaner? It targets browser issues.

    https://www.nicolascoolman.com/download/zhpcleaner/

    ~bhringer

    Was this answer helpful?

    7 people found this answer helpful.
    0 comments
  4. Anonymous
    2018-03-01T00:50:19+00:00

    I’ve already run scans with Malwarebytes and the Kaspersky Virus Removal Tool, and nothing shows up – but I just noticed something odd when I went to research Trojan:JS/Flafisi.D: Except for the first item on the search results list, which is this local thread:

    https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/trojanjsflafisid/b70661cc-5b98-4e9b-9db4-f76d5b1bb69c

    I just get pages and pages of SpyHunter sponsored sites in different languages. So now I’m wondering if my issue might be the effect of some undetected browser hijacker.

    GreginMich

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  5. Anonymous
    2018-02-28T23:42:56+00:00

    We’ve already had several confirmations that Trojan:JS/Flafisi.D is being detected while reading news articles on the Edge Start page, and this is emphatically not the new normal – we don’t normally have to worry about malware attacks and Tech Support Scams on respectable sites. But now we’re seeing them on the Microsoft Start page, so this really is surprising. If it isn’t possible to manage the security of websites, and to clean them up once they’ve been compromised, then we’re in a world of trouble here – because the Edge Start page will then have to be added to the list of risky sites, and blocked by Windows Defender SmartScreen. So if Microsoft can’t focus on the here and now, and fix this issue, then I’m not even sure that it will have a future.

    This thread was simply intended as a wakeup call – we’re being attacked by malware on the Edge Start page, and this is not business as usual.

    GreginMich

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments