I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2018-04-20T16:23:30+00:00

    Hi Rodrigo,

    This thing shows up almost every day when I'm browsing news articles on Edge (Windows 10).  It's always the same.... Flash Player issue and Defender IDs it as Trojan:  JS/Flafisi:D.  THANK YOU for your attention to resolving this annoyance.

    • Randy

    Was this answer helpful?

    0 comments
  2. Anonymous
    2018-04-20T16:51:16+00:00

    Hi Randy,

    I'm still trying hard to work through the data to narrow the down the offending ad. One thing that would help would be a fiddler trace of the issue as it happens and it would be more insightful than any work I could do on my end. I haven't asked folks here to do that since it's cumbersome and the issue doesn't repro every time so having a running trace in the background could be very large and end up sharing more info than you'd want. If you get this very often, it might be worth a shot. If you're so inclined

    • Fiddler is available here: https://www.telerik.com/download/fiddler. Let me know if you are willing to do that. I'll still keep working with my team so I can analyze the anonymous data to find the culprit. I want this thread to be active until we reach resolution so I'll post updates as I have them.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  3. Anonymous
    2018-04-21T19:37:38+00:00

    Hi, I got this js/Flafisi.D on different sites. One common one is finance.yahoo.com.  It totally takes over my page and wants me to download Adobe Flash Player.

    Thankfully Windows Defender has always blocked it!   Jim

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-04-23T21:05:03+00:00

    Defender detects and quarantines Trojan:JS/Flafisi.D almost daily and I remove it immediately.  Suggestions ?  Always when browsing MSN or CNN and I am using Edge exclusively.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2018-04-24T10:28:21+00:00

    I've just seen it while reading a Bloomberg article on MSN's website.  I hit the feedback button while the page was up and reported it.

    Was this answer helpful?

    0 comments