Frequently Asked Questions

This page is to help answer any questions you may have. If you do not see your question here, please e-mail us and we will try to answer it.

"In order to protect the security and integrity of Computer and Network Resources against unauthorized or improper use, and to protect authorized users from the effects of such abuse or negligence, the University reserves the rights, at its sole discretion, to limit, restrict, or terminate any account or use of Computer and Network Resources, and to inspect, copy, remove or otherwise alter any data, file, or system resources which may undermine authorized use." --AD20

---

Q. How do I report an incident to the Security Operations and Services (SOS) Office?

Q. What can I do if I feel harassed or threatened and wish to press charges?

Q. Where do I report unauthorized access attempts made against my computer?

Q. What is the proper format to submit logs of unauthorized access attempts made against my computer?

Q. How do I find my firewall logs?

Q. What do firewall logs look like?

Q. What can I do if I suspect that my password has been stolen or compromised?

Q. What do I do when I receive spam and what can the SOS Office do about it?

Q. What can I do about spyware?

Q. What are full headers and how do I get to them?

Q. Am I allowed to experiment with security-related software tools using Penn State resources?

Q. How can I communicate with groups of people at Penn State?

Q. How do I handle e-mail that I suspect came with a computer virus?

Q. For what purposes can I not use my Penn State Access Account?

Q. Are there additional resources that I can reference to answer my questions?

Q.  What ports are being blocked at the border of the Penn State Network?

Q. Where can I find information about the use of the University's indicia, consisting of various names, trademarks, and symbols?

Q. What can I do if Penn State University is blocking my mail?

 Q. Can I share my access account with members of my family?

 Q. Can I use my roommate’s Ethernet connection if my connection is disabled?

 Q. Can I set up a wireless connection in the Residence Halls?

 Q. Can I upload copyright material that I purchased on my personal web space?

 Q. Can I use my Penn State University user ID to advertise a commercial enterprise on my personal web space?

 Q. Are two antivirus programs better than one?

 

---

A. How do I report an incident to the Security Operations and Services (SOS) Office?

If you need to report an incident please e-mail security@psu.edu or call (814) 863-9533. For details on what you need to have available or included with the incident report please refer to the Incident Reporting page.

return to the top

A. What can I do if I feel harassed or threatened and wish to press charges?

If at any time, you feel threatened or harassed by any form of computer communication, and wish to press charges please contact Police Services immediately. Retain as much of the evidence as possible. Be sure to save everything. It can help the police track the harasser down, i.e. e-mail headers, date and time logs, IP addresses from IRC communication. We aid the police in many investigations, however, this type of situation falls under police jurisdiction due to the potential of physical harm.

A listing of non-emergency phone numbers for Penn State Police Services for different campuses is available.

return to the top

A. Where do I report unauthorized access attempts made against my computer?

If you detect that someone has attempted to access a computer without authorization, probe or "brake in" to your computer system, please submit the firewall logs of the unauthorized attempts to security@psu.edu or abuse@psu.edu, without log files we may be unable to continue our investigation into your incident. Immediately change your Penn State Access Account password at https://www.work.psu.edu/. For recommendations on how to create a strong password view the SOS suggestions.

return to the top

A. What is the proper format to submit logs of unauthorized access attempts made against my computer?

Please include the:

        Date

        Time

        Source IP Address

        Destination IP Address

        Port numbers that were involved

        Time zone that your machine/logs are set to

return to the top

A. How do I find my firewall logs?

Depending on what type of firewall you have running on your machine there are several ways to view the log files. For some of the most common firewalls, ZoneAlarm, Windows XP Service Pack 2, and Norton/Symantec the directions are found below.

To retrieve your ZoneAlarm firewall log:  

Unless you have moved or renamed the location of your firewall logs they can be retrieved in the following folder C:\WINDOWS\Internet Logs you will see them listed as text (.txt) files by date (File name: ZALog2005.02.15.txt).

Example of ZoneAlarm firewall log:

ZoneAlarm Logging Client v5.5.062.004

Windows XP-5.1.2600-Service Pack 2-SP

type,date,time,source,destination,transport (security)

type,date,time,virus name,file name,mode,e-mail id (antivirus)

type,date,time,source,destination,action,service (IM security)

FWIN,2005/02/09,17:52:14 -5:00 GMT,65.254.xx.xxx:0,146.186.xxx.xxx:0,ICMP (type:8/subtype:0)

FWIN,2005/02/09,17:52:42 -5:00 GMT,65.254.xx.xxx:32786,146.186.xxx.xxx:33452,UDP

FWIN,2005/02/09,17:52:44 -5:00 GMT,65.254.xx.xxx:32786,146.186.xxx.xxx:33453,UDP

FWIN,2005/02/09,17:52:48 -5:00 GMT,65.254.xx.xxx:32786,146.186.xxx.xxx:33454,UDP

FWIN,2005/02/09,17:52:50 -5:00 GMT,65.254.xx.xxx:32786,146.186.xxx.xxx:33455,UDP

FWIN,2005/02/09,17:52:54 -5:00 GMT,65.254.xx.xxx:32786,146.186.xxx.xxx:33456,UDP

FWIN,2005/02/09,17:52:56 -5:00 GMT,65.254.xx.xxx:32786,146.186.xxx.xxx:33457,UDP

FWIN,2005/02/09,17:53:24 -5:00 GMT,65.254.xx.xxx:0,146.186.xxx.xxx:0,ICMP (type:8/subtype:0)

FWIN,2005/02/09,17:53:52 -5:00 GMT,65.254.xx.xxx:32780,146.186.xxx.xxx:33450,UDP

FWIN,2005/02/09,17:53:54 -5:00 GMT,65.254.xx.xxx:32780,146.186.xxx.xxx:33451,UDP

FWIN,2005/02/09,17:53:58 -5:00 GMT,65.254.xx.xxx:32780,146.186.xxx.xxx:33452,UDP

FWIN,2005/02/09,17:54:00 -5:00 GMT,65.254.xx.xxx:32780,146.186.xxx.xxx:33453,UDP

FWIN,2005/02/09,17:54:04 -5:00 GMT,65.254.xx.xxx:32780,146.186.xxx.xxx:33454,UDP

FWIN,2005/02/09,17:54:06 -5:00 GMT,65.254.xx.xxx:32780,146.186.xxx.xxx:33455,UDP

return to the top

To retrieve your Windows XP Service Pack 2 firewall logs:  

Unless you have moved or renamed the location of your firewall logs, they can be retrieved in the following folder C:\WINDOWS\Internet Logs. You will see them listed as text (.txt) files by date (File name: ZALog2005.02.15.txt).

Example of Windows XP Service Pack 2 firewall logs:

Category: Firewall
Date,Message,Details
2/3/2005 11:22:44 AM,An instance of "C:\Program Files\Symantec Client Security\Symantec Client Firewall\IAMSTATS.EXE" is preparing to access the Internet.,An instance of "C:\Program Files\Symantec Client Security\Symantec Client Firewall\IAMSTATS.EXE" is preparing to access the Internet.
2/3/2005 11:15:16 AM,Unused port blocking has blocked communications.,"Unused port blocking has blocked communications.  Inbound TCP connection.   Remote address,local service is (210.45.xxx.xxx,3306)."
2/3/2005 11:15:13 AM,Unused port blocking has blocked communications.,"Unused port blocking has blocked communications.  Inbound TCP connection.   Remote address,local service is (210.45.xxx.xxx,3306)."
2/3/2005 11:00:09 AM,TCP non-syn/non-ack packet on invalid connection. Packet has been dropped.,"TCP non-syn/non-ack packet on invalid connection. Packet has been dropped.  Source IP address: xxx.psu.edu(146.186.xxx.xx).  Destination IP address: xxx.psu.edu(146.186.xxx.xxx).  TCP Source Port: 995.  TCP Destination Port: 1507.  Flags: 0x00000011."

 

A. How do I handle e-mail that I suspect came with a computer virus?

NEVER open an attachment from a stranger and be highly suspicious of attachments from friends. The worm-type viruses utilize personal Internet address files to distribute the virus among unsuspecting acquaintances of the infected sender.

Penn State has a site-license for Symantec Anti-Virus for students, staff, and faculty. We urge you to install an Anti-Virus program OR if you already own one, please update the virus definition files.

Current information on today's viruses and worms:

The Symantec AntiVirus Research Center
McAfee AntiVirus Site
F-Secure Virus Information Center

For additional assistance, please contact:

(814) 863-2494 - Computer Building
(814) 863-1035 - Willard Building
Toll-free 1-888-778-4010 within Pennsylvania
http://helpdesk.psu.edu/
helpdesk@psu.edu

return to the top

 

A. For what purposes may not I use my Penn State University Access Account?

Here are a few examples of activities you CANNOT use Penn State Access Accounts or Network Access for:

 

* MASS UNSOLICITED E* CHAIN e-mail
* ELECTRONIC MAILINGS AND NEWS POSTS
* COMMERCIAL ADVERTISEMENT
* CONDUCT SECURITY EXPERIMENTS OR SECURITY SCANS WITHOUT SPECIFIC AUTHORIZATION OF THE DIRECTOR OF SECURITY OPERATIONS AND SERVICES
* TRANSMIT OR MAKE ACCESSIBLE OFFENSIVE, OBSCENE OR HARASSING MATERIAL
* SHARE YOUR PENN STATE UNIVERSITY ACCESS ACCOUNT WITH ANOTHER PERSON
 

return to the top

If you are unsure about something you are doing, first read Policy AD20 (Computer and Network Security). If your question is still unanswered, e-mail us at security@psu.edu and we will help you. Again, if you are unsure if something you are doing is a violation of policy, DO NOT do it!!!!

return to the top

A. What can I do if Penn State University is blocking my mail?  

Sometimes it appears as though Penn State is blocking your e-mail when unfortunately, your IP address may appear on a Dial-Up User List (DUL),   a list that the University subscribes to, but does not maintain. In which case please have someone from your ISP go to the following URL and request that they be removed from the Dial-Up User List. 

http://www.mail-abuse.com/removereq_dul.html

In order to determine if Penn State networks are blocking your e-mail please submit the following info to security@psu.edu

It is crucial that we receive the following information from complainants to include the full bounced message::

Final-Recipient: RFC822; <xxx@psu.edu>
Action: failed
Status: 5.1.1
Remote-MTA: dns; xxx.psu.edu (146.186.xxx.xxx)
Diagnostic-Code: smtp; 550 5.7.1 Rejected: 68.230.xxx.xx see http://aset.its.psu.edu/spamfilter.html for information
 

return to the top
 

 A. Can I share my access account with members of my family?  

No, Penn State Access Accounts are intended for use by a single individual. Group Access Accounts will not be authorized. In extraordinary circumstances, they may be authorized under AD20 with the explicit written permission of the Senior Director of ASET. Each of the following conditions must hold for approval:

1. The Account will be used for explicit purposes specified in writing.
2. No other means exists for providing equivalent service.
3. The service is deemed critical by the Senior Director of ASET.
4. One person will be designated as responsible for the Group Account.

return to the top
 

 A. Can I use my roommate’s Ethernet connection if my connection is disabled?  

No, Penn State Access Accounts are intended for use by a single individual. If you find that your Ethernet connection is disable contact ResCom.

return to the top
 

 A. Can I set up a wireless connection in the Residence Halls?  

No, as stated in AD20, "Respecting the physical hardware and network configuration of University-owned networks. System users must not extend the physical network on which their system resides (e.g., wiring, jacks, wireless connection)".

return to the top
 

 A. Can I upload copyright material that I purchased on my personal web space?  

No, the possession and/or distribution (to include making available online) of such files is in direct violation of state and federal laws, and University policy. The University regards such copyright offenses very seriously. System users must remove any copyrighted materials that they do not have the copyright holder's specific permission to possess. As noted above, they must not place such material on University systems or to personally-owned systems attached to the University network at any time and must not engage in unauthorized copying, transmission, distribution and/or downloading of such works.

return to the top

 A. Can I use my Penn State University user ID to advertise a commercial enterprise on my personal web space?

No, Penn State resources and services are intended for University-related use. Do not use these resources for purposes such as selling a product, a profit-making business or sales position, or in conjunction with mass mailings. If you need to use the Web, e-mail, or Netnews for purposes unrelated to Penn State, use a commercial service. Many companies known as Internet Service Providers (ISPs) offer Web space and e-mail services. One method of finding an ISP is to use a search engine such as http://www.google.com/. Also see the following policies:

• AD08 Procedures for the purchase of display advertising http://guru.psu.edu/policies/AD08.html
• AD20 Computer and Network Security: http://www.guru.psu.edu/policies/ad20.html
• AD27 Commercial Sales Activities at University Locations: http://www.guru.psu.edu/policies/ad27.html
• AD52 Links To or From Penn State Web Pages: http://www.guru.psu.edu/policies/ad52.html

return to the top
 

 A. Are two antivirus programs better than one?  

When running Penn State's licensed antivirus program Symantec, it is strongly recommends that you run only one antivirus program at a time. You may also wish to use a standard space browser. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. Your best defense against computer viruses and malicious programs is to keep your virus definitions up to date, and run Norton AntiVirus Auto-Protect. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time. (The Norton AntiVirus module that is active in memory is named Auto-Protect. Other antivirus programs will have different names for this function.)

• Download Symantec (FREE for Penn State students, faculty, and staff )
• Other Antivirus Software Vendors
   

return to the top