I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-04-10T16:52:15+00:00

    Could you please submit a piece of feedback when you see the CPU that high again? Write "perf issue - ad hogging CPU" on the text so I can pick it up and investigate. We've seen several instances of when the ads are sneaky to pass the blocks we have at the exchange and just killing the site when they load on the pages. For the most part, the tracking scripts on the ads (something they do to measure if you have the ad visible or scrolled the page out of it) are just poorly written.

    Was this answer helpful?

    0 comments
  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  3. Anonymous
    2018-04-10T13:47:17+00:00

    Thank you, Rodrigo – for replying; for putting this thread back on track; and most of all, for your efforts to engage this menace at the front lines. I’m hoping to just fade into the background now, and simply report any observations that I think might be relevant.

    I didn’t see any malware or scamware at all yesterday, and that allowed me to leave some MSN news pages open (my usual capture method) for longer than usual (up to an hour). When I returned to this PC after eating supper, I was barely able to load Task Manager and the Snipping Tool in order to capture this screenshot:

    https://www.msn.com/en-us/news/politics/fbi-raids-office-of-trump’s-longtime-lawyer-michael-cohen/ar-AAvGRqH?ocid=spartandhp

    After Edge crashed, it slowly auto-recovered (something I’ve never seen before); and then after closing the news page, the system recovered quite quickly. I’m not sure where the “missing CPU” came from in this observation, but Windows Problem Reporting has been kicking in lately when I see these resource/performance issues.

    Later last night, I saw the same issue with this page:

    https://www.msn.com/en-us/news/politics/‘a-bomb-on-trump’s-front-porch’-fbi’s-cohen-raids-hit-home-for-the-president/ar-AAvHeTw?ocid=spartandhp

    And then again this morning, with this page:

    https://www.msn.com/en-us/news/politics/mcconnell-sends-warning-over-nomination-votes/ar-AAvHdvS?ocid=spartandhp

    I think I might have inadvertently opened up a second news tab in this last observation, and that definitely seems to exacerbate the issue. So anyone else who's seeing these performance issues with news pages should be able to magnify the effect by simply opening up a second news tab.

    GreginMich

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-04-10T02:23:43+00:00

    Hi Rodrigo

    I am still getting Flashplayer.hta page redirection if I am using MSN page(s) on Edge. Today I was watching below news and right after commercial video, page got redirected to adobe flash player page with popup to run it. 

    My observation is that if the page redirection happens once for a particular MSN page, it won't come again for the same page no matter how many times I revisit. But it will come again sometime or next day  for another MSN page(s).

    I faced this only for MSN pages and no other website. 

    https://www.msn.com/en-us/money/companies/trumps-food-stamp-crackdown-could-wallop-walmart/ar-AAvGbca?ocid=spartanntp

    Any help to remove or block this will be greatly appreciated. 

    Thank you.

    -Bhavesh

    Was this answer helpful?

    0 comments
  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more