I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-03-05T23:03:21+00:00

    I have been getting these when I go into a story featured on my.yahoo. Defender was allowing this to be displayed DESPITE setting the action to block from warn. So now I am using Norton Security Suite. The page/tab/website is removed along with a Norton message that it blocked an intrusion from 159.65.226.135 Fake Tech Support Website 165.   I believe Norton is better at explaining what happened and does not let the page display. Perhaps Edge/Defender needs to do that.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2018-03-05T02:18:15+00:00

    I did run a full scan after removing it, thanks Greg, It is, indeed, gone.

    I don't know but I think this is part of what the Exploit Protection tools in our Windows Defender Security Center are for.

    Of course, I could be wrong...but I am working with these settings.

    Was this answer helpful?

    0 comments
  3. bhringer-9380 4,350 Reputation points Volunteer Moderator
    2018-03-04T06:29:03+00:00

    Just for shirts and giggles flush DNS cache and then use OpenDNS on test machine.

    Britec09 has decent video for reference.

    https://www.youtube.com/watch?v=xkx4tRWm5_Y

    Video title "How To Increase Your Internet Speed with Open DNS" applies but also consider Cisco acquired OpenDNS a while back to enhance their security, has some effective blocking features.

    ~bhringer

    Would have replied sooner if MS servers hadn't  been experiencing issues.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-03-03T01:10:04+00:00

    WUPS! I spoke too soon. Let me update this a little.

    Yes, it has now been quarantined just since the Restart:

    and you can see it there. But remember, neither MSN nor Bing are the "Edge" Homepage. 

    The Edge Homepage doesn't actually have news articles. The Edge Homepage actually looks like this:

    Anyway, the Trojan was still never a real threat. The Windows Defender Security Center caught and quarantined it without my having to do anything except (in a minute) go and remove it.

    Was this answer helpful?

    0 comments
  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more