I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Hey Greg,

I've seen reports of those coming from any page that includes advertising, including MSN which is the source of the default page for Edge as well as IE 11 as I recall.

I turned off these start pages in favor of a blank page immediately myself, not for this reason, but rather simply because I don't like the lag and noise these create when I open a browser.

I did have difficulty figuring out how to stop them with new tabs in IE 11 though, until I found out there was a separate control for this within the Internet Options - Tabs section on the General tab.

As Julia often mentions as well, I've found that ad blocking is the most effective method to stop these, since it's the advertising networks who distribute the initial scripts and typically don't vet their advertisers well if at all.  What a surprise huh?

Rob

I’ve seen that specific popup numerous times using Edge, using Chrome, using Internet Explorer, using Win 7, using Win 10, using a Vista, using Windows Defender, using Emsisoft Antimalware, using Kaspersky Free and with one common denominator…Yahoo webpage.  Have received complaints from acquaintances about the same popup –  also on Yahoo.

Yahoo says there is nothing wrong on their webpage and that the issue must be on all of the computers I’m using.  Uh Huh!  Yeah!  Sure!

No problems closing down the browser when I see the popup though once I had to use Task Manager.  No suspect browser extensions found and "Quick Scans" after restart found nothing either.

Have not seen in a couple of weeks on any computers I'm using though there’ve been more reports of it on the forum.

I’m certainly not surprised to see something like this while I’m using the Edge browser – but I’ve never seen anything like this on a Microsoft site before, and I’ve been browsing from the Start page every day since Edge was launched – first multiple detections for Trojan:JS/Flafisi.D last week, and now this. Since Microsoft's home page is a big source of advertizing dollars these days, I would expect Microsoft to show a little interest in cleaning up its act – just to keep users from switching over to another startup page (or another browser), or from installing an ad-blocker. But I sure appreciate the feedback here, because I wasn’t fully aware of the scope of this issue.

GreginMich

I understand what you're saying and from what I've personally seen, Microsoft's pages receive less of these than most others.  However, the design of the advertising structure itself is the real problem here and always has been.

As I understand it, the ad networks contract to provide advertising to the page owners like Microsoft, which they then use to supply access to particular demographic groups to the advertisers, who buy these by blocks of ads.  With this isolation between advertiser and page owner, it's the ad networks that are responsible for vetting and with the margins they make, there's little interest by them in performing this action.

I believe I've seen mention of yet another layer in these transactions, but even without this it's easy to see why the problem exists.  The page owner simply wants revenue, as does the ad network and the advertiser just wants their ad to reach lots of potentially valuable eyes.  In the case of popup purveyors, the demographics are only partially important, since what they're truly after is simply potential targets who might be prone to responding to their scams, which could be anyone.

With the trends towards more targeted systems and apps, the interest in general web pages is declining, so this makes any additional effort to protect and maintain this avenue of less concern at all levels as well.  I think we're simply seeing a symptom of this decline as the more knowledgeable user moves away from the browser to devices with apps, which by their nature are less susceptible to such simplistic forms of attack.

Just think back about the typical type of user we've seen here over time, with the more knowledgeable mostly disappearing as those still holding onto the older technology appear to be most common now.  It might seem that this is due to the better protection provided by Windows 10 and current security it includes, which to an extent may be true, but I feel it's more a reflection of this migration to modern devices and apps within the consumer market.

Rob

But passing the buck won’t help protect the people who use the Microsoft Start page, or solve the issue of trust. Sites that host malware like this are considered “compromised” – and since this is a Microsoft site, they’re ultimately responsible for doing whatever it takes to break the supply chain and clean things up. It’s not just about protecting their bottom line – it’s about protecting their reputation and their customers.

GreginMich