I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-08-16T17:22:01+00:00

    I got this malware on my computer this morning. Spoke with Joseph in tech support. Sent info on stopping from it happening again but don't see how to get rid of this now

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  2. Anonymous
    2018-08-15T12:40:37+00:00

    I get three versions of this AND use Windows Defender which is rendered useless

    When am I going to get a break for me too Amen...…….

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2018-08-13T19:10:08+00:00

    I get three versions of this AND use Windows Defender which is rendered useless

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  4. Rob Koch 26,075 Reputation points Volunteer Moderator
    2018-08-13T02:56:48+00:00

    After DAILY having to deal with support scam pop ups getting past my Windows Defender while using a Windows 8.1 operating system, I finally switched to Windows 10.  The very first day my wife was on line, the support scam popped up again.  Windows Defender is USELESS in defending our computer from these attacks.

    Yes Thomas, that's because most of these are simply browser popups and nothing more, so there's no malware present for Defender or any other AV or antimalware app to detect.  You might personally consider these "malicious", but in reality they're just text and HTML screen formatting attempting to catch the stupid and uninformed.

    Since the most common method the malicious actors use today in order to deliver these is via advertising networks and browser redirection, the top methods for blocking them involve the use of advertising blockers or privacy settings within the browser or Windows itself.

    As Microsoft and the app developers have closed the door on most direct attack vectors such as vulnerabilities within the operating system and apps, the malicious actors had moved first to directly invoking popups within the browsers and then to this current redirection delivered via ad networks.  Only the impending end of desktop Windows itself holds some promise that most of these attacks will eventually end, since its the multitude of vulnerabilities and legacy code that still exists that continues to enable this never-ending arms race.

    I personally never receive any of these popups myself unless I purposefully browse the darker corners of the Internet in an attempt to experience them.  That's due to the fact that I chose relatively excessive Privacy settings in both the Edge and IE11 bowsers, as well as Windows 8.1 and 10 within days of initially buying or installing the Windows upgrades to these systems.

    Ad blockers and other programmatic attempts at stopping these attacks as simply playing with fire, good privacy settings just dump cold water on the match before the fire can be lit.

    Rob

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  5. Rob Koch 26,075 Reputation points Volunteer Moderator
    2018-07-05T20:51:12+00:00

    Jesus,

    This thread has grown to many pages, so finding the instructions RodrigoLode from Microsoft provided many pages back is now difficult.

    Providing the kind of information you offered might help, but it's more important that they can find your specific activity within the millions of individual log entries daily.  The following response Rodrigo made to a user named "Taffy087" back on page 24 of this thread gives the most basic instructions.

    It's ok if you can't repro. I can go look in the history. Just need a seed so any feedback it's good. You can write "auto-redirect issue - please follow up - taffy" and I'll investigate from that. 

    So in your case, you should post something to MSN feedback like "auto-redirect issue - please follow up - jesus" and then return here and post a reply to one of Rodrigo's posts that you've completed this with exactly what you posted to feedback so he can find it.

    The MSN feedback button is displayed on any page while browsing the MSN website and appears as you scroll down on the page somewhere in the lower right-hand corner as I recall, similar to the one displayed here for feedback to the Community website.  So make certain you are on the MSN website when you select the feedback button.

    Rob

    < EDIT > I should have made clear Jesus, that Rodrigo's group can only help with advertisements coming from via the MSN advertising networks, since that's where his group operates.

    Since I see you are having the issue while operating within Outlook email, I'm not sure whether Rodrigo can access that particular information or not, so he'll need to respond to that question.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments