I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2018-04-12T01:48:23+00:00

    Hi Gonzo, 

    I would love to go deeper into the telemetry data that led you to those problems in Edge. If you don't mind just sending some feedback with the following "Adobe ad fake flash player - please investigate", I can take care of it on my end. You can send the feedback from Chrome too, but best if you do it from Edge itself. From any article, just scroll a bit down to make the "feedback" button show up on the bottom right corner of the page; click on it and write the text in quotes above.

    Thanks for taking the time to share your experience. Once it's resolved, I'll update the thread here and give you all an update. 

    PS: my suspicion on why the malware cleaners are not solving the problem is that you got targeted for the ad that causes this by the exchange and the chances of it showing up again are high.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2018-04-12T01:50:55+00:00

    Hi TaliaTurner,

    Next time you open edge, please send some feedback (lower right corner of the page) and write "Edge red screen of death - ad hijack". This will help my team in investigating against telemetry. The telemetry I get is anonymous, so I need a clue to help investigate the ads served to you and this would help me identify it the relevant sequence on my end.

    Thanks,

    -Rodrigo

    Was this answer helpful?

    0 comments
  3. Anonymous
    2018-04-12T02:34:52+00:00

    Hi all,

    I'm on the MSN Engineering team and would love help if anyone encounter this again. We've been tracking this since it started in mid February. We do quite a bit of work to scan the ads we get from our exchanges, but some behave differently for certain users than they do when we do our scanning. In the future, please continue to submit feedback so we can narrow the scans on our end and potentially reproduce and remove this once and for all. If your page was hijacked and you couldn't view the article, please mention the article headline you've visited as well. 

    If anyone is still experiencing this, please reply here. 

    Thanks,

    -Rodrigo (MSN Engineering)

    Hi Rodrigo,

    Windows Defender just caught this Trojan twice. I recently had a fake adobe flashplayer update (it had a bogus looking URL). I did not open it. It appeared with opening a legit story from an odd source on the MSN Homepage.

    Best,

    John

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-04-12T02:42:49+00:00

    John,

    Could you please go to any article and submit a new piece of feedback with the following comment: "Adobe ad fake flash player - please investigate"? The feedback button should be at the lower right corner of the page. That will help me in trying to narrow down the ad that is causing this.

    Thanks for taking the time to report it here! This has been an issue difficult to track, but with the help of every poster here, I'm hoping I can bring this down. 

    -Rodrigo

    Was this answer helpful?

    0 comments
  5. Anonymous
    2018-04-12T18:19:23+00:00

    I'm getting pop-up  whenever I'm on Ancestry.co.u,Ebay  and now Twitter. The same ads on all sites. Most of the ads are verging on pornographic but also a lot of Flash Player ads. I'm having to constantly scan my laptop and remove Trojans. 

    This only started within the last few months. Never had problems before. I hadn't changed any settings before it started. Getting to the point where there are that many ads I can't see the page! On the verge of scrapping my laptop and getting a new one!

    Was this answer helpful?

    0 comments