I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Rob Koch 26,075 Reputation points Volunteer Moderator
    2018-03-30T21:04:04+00:00

    Greg,

    We were both looking on the wrong direction here, focusing on the current malvertising symptom while the deeper issue was occurring inside Microsoft itself.

    After Thursday's announcement and it's obvious side effects, I did a quick search today regarding layoffs and found the second article below.

    Windows boss Terry Myerson leaving Microsoft amid huge reorganization - Business Insider

    Microsoft Layoffs in 2018 Impact Windows and Device Group

    "Although the most severely impacted part of the business is the Windows and Devices Group, several other divisions faced job cuts as well. Employees were shed from product groups like “Bing”—the company’s oft-maligned search engine answer to “Google.”"

    Since the MSN moniker is really just a legacy label that's likely now nothing more than a logo, I'd guess that most of the remaining portions of this advertising were driven by the Bing group mentioned in the previous excerpt.  If that group was already being reduced earlier this year before the announcement last Thursday, then I'd bet there's no plan to retain these legacy components for the long term, since as I mentioned these were nothing more than a reformatted set of 3rd-party news blogs anyway.

    So I think that assuming Microsoft truly cares what happens to these pages is the mistake here, while it's the larger issues of where Windows itself is really headed and what form it takes in the future of Microsoft itself that's truly of concern at the moment.

    "Terry Myerson, the executive vice president of Windows who has long been a leader at Microsoft, will leave the company "in the coming months" as part of a big reshuffling of executive leadership announced on Thursday. "

    So if I'd taken the time to research deeper at the beginning, I'd have realized this entire discussion was pointless from the start, except as a warning that Windows users should assume that ad blocking is now the only effective method to protect yourself from malvertising on the legacy Windows platform.

    Rob

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments
  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  3. Anonymous
    2018-04-07T22:26:19+00:00

    Hi all,

    I'm on the MSN Engineering team and would love help if anyone encounter this again. We've been tracking this since it started in mid February. We do quite a bit of work to scan the ads we get from our exchanges, but some behave differently for certain users than they do when we do our scanning. In the future, please continue to submit feedback so we can narrow the scans on our end and potentially reproduce and remove this once and for all. If your page was hijacked and you couldn't view the article, please mention the article headline you've visited as well. 

    If anyone is still experiencing this, please reply here. 

    Thanks,

    -Rodrigo (MSN Engineering)

    Was this answer helpful?

    90+ people found this answer helpful.
    0 comments
  4. bhringer-9380 4,350 Reputation points Volunteer Moderator
    2018-04-09T01:10:32+00:00

    Hi all,

    I'm on the MSN Engineering team and would love help if anyone encounter this again. We've been tracking this since it started in mid February. We do quite a bit of work to scan the ads we get from our exchanges, but some behave differently for certain users than they do when we do our scanning. In the future, please continue to submit feedback so we can narrow the scans on our end and potentially reproduce and remove this once and for all. If your page was hijacked and you couldn't view the article, please mention the article headline you've visited as well. 

    If anyone is still experiencing this, please reply here. 

    Thanks,

    -Rodrigo (MSN Engineering)

    Hi Rodrigo,

    Your attention to this issue is greatly appreciated by myself as CM and I'm sure other frequent contributors  in Virus & Malware. We seldom get engagement from members of technical teams

    To assist in generating more feedback I am requesting this thread be pinned and I have also edited to OP to reflect your request. I included a direct link to your reply as it is somewhat obfuscated being on Page 7

    Thanks.

    ~bhringer

    PS As an aside FWIW I noted you replied to another participant in this thread. Out of respect and as part o general accepted protocol your reply should have been to the OP..

    Was this answer helpful?

    10+ people found this answer helpful.
    0 comments
  5. Anonymous
    2018-04-09T21:31:57+00:00

    Thanks for the pin and for the heads up to reply to OP. I'll follow that guideline going forward.

    Was this answer helpful?

    9 people found this answer helpful.
    0 comments