I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2018-04-24T15:32:15+00:00

    It seems we may have this "malvertising" thing.  I'll share all I can hopefully the layperson account of a partially witnessed occurrence will benefit your effort..

    We were sitting at the computer watching a video taken by an individual with a telephone.  Afterward I downloaded a pdf file which accompanied the video link.  I happened to notice the link to YouTube contained a period in the middle of the words youtu.be or yout.ube.  Weird to me so I made a note to check it out later.  5 minutes or so after this he was attempting to launch edge (it might of been explorer - latest release of either) he saw a pop-up warning about a virus.  He said it was from wave but I think it popped up through explorer after opening the wave cable e-mail in box.  When I saw it there was a gray /blue popup and what sure seemed like a mock blue screen behind it.  I didn't get to read any of it fully and only saw it for a few seconds as he turned it off in a panic.

    So far I've check my disk completely and am running into difficulty with updating viewing last updated to defender. I'm working to figure out what to do about this next and stumbled over your posted request for information.  Hope this is helpful.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2018-04-24T16:28:31+00:00

    Yes, I just got the Trojan: JS/Flafisi.D again while reading a article on MSM.   Would it help to remove Adobe Flash Player altogether and reinstall if needed?  If so, how would I go about the removal?   I don't see it listed in programs.     Thanks for any help!

    Was this answer helpful?

    0 comments
  3. Anonymous
    2018-04-24T17:00:47+00:00

    Thanks angmargre! This data helps! Could you let me know a couple of the words you included in the feedback so I can look it up?

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-04-25T08:55:08+00:00

    I didn't. I couldn't see a space for comments in the menu.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more