I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

I didn't say anyone was passing the buck here, though it's obviously possible in this scenario, it's just not possible to truly manage the security of these advertisements when such a convoluted, layered set of systems exists.

I don't think Microsoft is ignoring this or they'd be spewing far grater numbers of these similar to the issues that Le Boule mentioned Yahoo has been generating lately.  I've personally never seen a single such popup generated by any Microsoft website and only one single popup in all my years of normal browsing.

On the other hand, I can experience dozens of these in a single session of purposefully risky browsing behavior, most generated directly by the websites being browsed.  This is most likely where many of the reports we see here daily come from, though some number are also clearly experienced via advertising on news pages and the like.

I think that Microsoft is more focused on the future of Windows itself, including not only Windows 10 S, but also the Windows Core OS including the Polaris version targeted at consumers and other light-duty users.  I suspect that this is where they'll actually solve these types of problems, since many of these problems exist due to legacy components more often used in business.

Rob

We’ve already had several confirmations that Trojan:JS/Flafisi.D is being detected while reading news articles on the Edge Start page, and this is emphatically not the new normal – we don’t normally have to worry about malware attacks and Tech Support Scams on respectable sites. But now we’re seeing them on the Microsoft Start page, so this really is surprising. If it isn’t possible to manage the security of websites, and to clean them up once they’ve been compromised, then we’re in a world of trouble here – because the Edge Start page will then have to be added to the list of risky sites, and blocked by Windows Defender SmartScreen. So if Microsoft can’t focus on the here and now, and fix this issue, then I’m not even sure that it will have a future.

This thread was simply intended as a wakeup call – we’re being attacked by malware on the Edge Start page, and this is not business as usual.

GreginMich

I’ve already run scans with Malwarebytes and the Kaspersky Virus Removal Tool, and nothing shows up – but I just noticed something odd when I went to research Trojan:JS/Flafisi.D: Except for the first item on the search results list, which is this local thread:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/trojanjsflafisid/b70661cc-5b98-4e9b-9db4-f76d5b1bb69c

I just get pages and pages of SpyHunter sponsored sites in different languages. So now I’m wondering if my issue might be the effect of some undetected browser hijacker.

GreginMich

Ever tried ZHPCleaner? It targets browser issues.

https://www.nicolascoolman.com/download/zhpcleaner/

~bhringer

I’ve reproduced the search engine issue on a couple of other PCs by just searching for “Trojan:JS/Flafisi.D”. Is this SEO poisoning gone crazy, or is there maybe a deeper issue here (it’s almost as bad as the local search engine issue). This is all too much extra work if I can’t find a usable search engine, so I’m inclined to just sit back and let things run their course. This issue definitely seems to be a parallel with the Yahoo issue, since these attacks are clearly site-specific – but then again, it’s hard to prove that there’s a general issue when the attacks are so sporadic. Tomorrow I’ll see if I can reproduce the detection/scam on a second machine, and maybe run some more scans on this one. So thanks for that tip, bhringer.

GreginMich