Within the last couple of days, my anti-virus program began detecting malware on the forms I've created and won't let me access them.

  • Profile Image
    studentactivities
    Asked on December 04, 2012 at 02:49 PM

    Like I said, this has only happened in the last couple of days, and this hasn't been a problem before. I can access the site and edit the forms, but once I've completed editing them, I (and everyone else on our campus, because I work at a university) cannot access the forms to fill them out because it is detecting malware. What should we do? Is this something that you need to fix?

     

    And this isn't just happening with one of our forms, it's happening with all of them.

  • Profile Image
    pinoytech
    Answered on December 04, 2012 at 03:16 PM

    Hi there,

    We apologize for the inconvenience that may have caused. Can you contact Sophos and ask them to whitelist form.jotform.us?

    Thank you!

  • Profile Image
    studentactivities
    Answered on December 04, 2012 at 03:42 PM

    Well, I talked to one of the IT guys at our institution, and he was hesitant to do that. Here was his response:

     

    You are going to have to contact them (JotForm) and let them know that Sophos is detecting a virus/Malware on their site.  It is very rare that we see notification blocks from Sophos and until proven otherwise I am very reluctant to assume that this is not a legitimate threat.

     

    So I'm not sure where else to go or what else to do. If you can get the site whitelisted from your end, that would probably be best, because the institution is not willing to do it.

  • Profile Image
    jeanettebmz
    Answered on December 04, 2012 at 04:23 PM

    We understand your concerns, however we are already in contact with Sophos. They marked the site as a threat due to several reports about phishing coming from our forms.

    As you may understand we host million of forms, and many of them are used for Phishing purposes , of course . However, in our efforts to fight against phishing, we have a dedicated team to review forms and block them on a daily basis.

    So, at any rate,  our site itself is not the problem but many of the forms that are being created for phishing purposes. 

    Below find part of the communications we are having with the support department at Sophos



    ---------- Forwarded message ----------
    From: Jotform Support <support@jotform.com>
    Date: Tue, Dec 4, 2012 at 2:46 PM
    Subject: Re: [#3576754] Re: Whitelisting of Jotform domains
    To: Sophos Support <support@sophos.com>


    Hello Sophos Team,


    Thank you very much for your answer.

    We do understand you concerns, and we would like to deal with the problem. 

    Our business is based on the Online Form Builder Tool that is used by more than 750,000 registered users all over the world. As you may understand, we host millions of forms, so that the phishing issue is real, but I have to say that we are working hard on it.

    We have an automated phishing filter, that blocks suspicious forms and accounts based on different criteria. 

    Moreover, we have dedicated employees who are working on the Manual Phishing Detector on a daily basis.

    Here is a screenshot from the Phishing Detector:


    In other words, the phishing forms are being blocked really fast. If you have some links to the active phishing forms, please let us know, so that we will be able to clock them instantly.
    Several completely legal customers have contacted us recently about that issue with the High Risk Website warning. We hope that you will find our arguments valid, and whitelist the jotform.us domain as soon as possible.
    Best Regards,
    Mike
    JotForm Support Team

    On Tue, Dec 4, 2012 at 6:09 PM, Sophos Support <support@sophos.com> wrote:
    Hello Support,

    I received the report back from the labs and this is a legitimate block not a false positive.  We block this site since it has repeatedly been infected with pages used in spam phishing campaigns. Our records show 64 incidents between March and November this year.

    At the moment it has to stay blocked as infected/high risk until the owner of the site can provide a more secure solution.  Thanks!



    Regards,

    Derrick Yue
    Sophos Technical Support
    http://www.sophos.com/support/services/technical.html

    Support knowledgebase: http://www.sophos.com/support
    Follow us on Twitter @SophosSupport
    SophosTalk community (discussion forums): http://community.sophos.com

    SOPHOS - simply secure

     

  • Profile Image
    fxr
    Answered on December 05, 2012 at 09:17 AM

    Sophos have got back to us on this and realized the miscatergorization and have corrected it.

    Can you please confirm that you are now able to access your forms as normal now?

  • Profile Image
    studentactivities
    Answered on December 05, 2012 at 09:21 AM

    We still cannot access our forms, but we're working on whitelisting our forms from our end now too.

  • Profile Image
    studentactivities
    Answered on December 05, 2012 at 09:29 AM

    Actually, now we can access them. I just checked again, and all of our forms are accessible. Thanks for your help!