I’m seeing Trojan:JS/Flafisi.D detections and Tech Support Scams on the Edge browser Start page

Anonymous
2018-02-28T16:36:56+00:00

Update: A member of Microsoft's MSN Engineering Team (RodrigoLode(MSFT) has responded to acknowledge the malvertising issues associated with MSN portal. They have also requested ***" If anyone is still experiencing this, please reply here."***For more specifics on information requested please refer to the reply from Rodrigo at the following link:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f?page=7&messageId=3661a31c-2019-4808-a88b-283919038cc1

In addition to reporting the fake pop-ups themselves I would advise that you take note if there is a significant loss of performance on computer after encountering, in particular, the fake Adobe Flash Player update. If things seem sluggish you may have been subject to one of the more prevalent malicious activities known as crypto-mining/coin mining.

Invisible resource thieves: The increasing threat of cryptocurrency miners

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/

Especially important to report these occurrences or any other odd behaviors after using MSN website.

Moderator Edit: Provided update.

Just reading the “Comey trolls Trump” article on the Edge Start page and this pops up:

 This one was easy to handle because it was just the old-fashioned dialog loop based scam:

– but what’s coming next Microsoft?

GreginMich

[Original Title: Surprised again]

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

386 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-08-12T14:50:14+00:00

    Besides which I thought we were talking about Trojan:JS/Flafisi.D. (not ads in general)

    It blocks that alright.

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  2. Anonymous
    2018-05-01T22:01:39+00:00

    I'm just as frustrated at these issues as most of you are. My team has been working on trying to identify the culprit - we believe an ad is at play, but the ad creatives have been sneaky in hiding their tracks and we're sifting through terabytes of telemetry data that could potentially lead into finding the culprit. Once we do, we'll block it and go after the folks who designed it so we can prevent from happening. 

    I apologize for the delay in getting this resolved. It has proven trickier than I expected. For those who do get this often, the idea thing would be have fiddler running at the same time and save the trace for my team to review, but it's a hard to ask of anyone so I'm pursuing the route of telemetry data analysis instead.

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  3. Anonymous
    2018-03-29T14:31:30+00:00

    Thank you...I've been having both these issues for weeks now, and I was so puzzled because I've been using Windows Defender, and I never go to pages where I would expect something like this to happen...usually just MSN sites...I thought they were relatively "safe".  I'm old and not really tech savvy...your recommendation to use an Ad Blocker is what I'm going to try next, since I did every single thing that Windows Defender told me to, and it keeps happening.

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  4. Anonymous
    2018-03-07T04:05:38+00:00

    OK. Just got hit again while visiting the MSN homepage. Didn't even click on a story. The Trojan just appeared: 

    Microsoft is going to have to escalate this issue. Yes, Defender intercepted and quarantined it until I could remove it manually. But I am disinclined to get my news from MSN while this is happening.

    I mean...just how VULNERABLE IS this site, anyway?

    Yeah. It's gone. I am undamaged. But, as GreginMich has pointed out:

    It should NOT be there!

    Are the Techs at Microsoft actually DOING anything about this?

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  5. Anonymous
    2018-03-03T00:59:39+00:00

    Hello, Greg. I DO humbly apologize. I have now seen the problem you are talking about. At least, I believe so. I am not sure which page is the "Edge" homepage, You mentioned "News Articles" so I brought up MSN...the usual default homepage for Microsoft and found myself reading about Alec and Alex Baldwin when you're favorite Flash Player Alert appeared.

    I was further informed that "Smart Screen" had been turned off and that that very Trojan required attention from my Windows Defender Security Center.

    Yet, when I opened the Security Center (as you do) I found no trace of this thing downloading, installing, having been installed, OR having been quarantined (which it would have been had it gotten in).

    Also, oddly, my Smart Screen was actually ON---not OFF as my "Notifications" would have it.

    ALL of which tells me that someone has written a pretty clever bot designed to panic us the hell out by making us think they've broken through all our security but, in all actuality, they had done nothing of the sort.

    To make certain I restarted my device, updated my antivirus re-ran the scan, and even checked my Security Screen (still on).

    So, no danger. BUT I AGREE Microsoft needs to jump on this ASAP and kudos to you, mate, for bringing attention to it!

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments