Question: 

I receive spam e-mail or returned message failures from kent.edu addresses, including my own.  Does this mean that my (or my colleague's) computer has been hacked?

Answer: 

The majority of "kent.edu" spam you see is simply from a forged address, and no more than an annoyance.  It is very easy to send an e-mail that looks like it's from someone else.  Spammers use forgery when sending messages because it increases the likelihood that their e-mails will be read when they appear to have come from a legitimate source.

Although less likely, your computer, or someone's you know, may be infected with a "spam-bot," which is software that allows spammers to send their messages using your computer.  These messages can appear to be from your e-mail address, but often do not.

The university has several safe-computing requirements that protect you from most malware threats, like spam-bots.

• Run McAfee Anti-Virus and download updated signatures at least once per day.

• Run a firewall to prevent incoming connections to your computer.

• Promptly apply updates and patches to your operating system and software.

For additional assurance, you can download and run SpyBot Search & Destroy ( http://www.safer-networking.org/) to search your computer for infections. 

You can also utilize anti-spyware features within McAfee to detect behavior on your computer that indicates that it may be infected.  The most useful feature to detect spam-bots is shown in the screen below:

mcafee8accscreen

The highlighted rule is "Prevent mass mailing worms from sending mail". If you instruct McAfee to Block and Report this activity, you will be notified any time an unauthorized program on your computer attempts to send e-mail.  Access this option by right clicking on the Virus-Scan shield in your system tray, selecting Virus scan console, right-clicking on Access Protection, then selecting Properties. You'll also want to make sure that the Enable Access Protection checkbox is turned on.

One final note: malicious software, in general, is becoming increasingly sophisticated and difficult to detect and remove.  If your computer behaves as if it is infected, such as running very slowly for no apparent reason, the only way to disinfect it in some cases is to erase the hard drive.  Reinstalling all of your software can be a time consuming process, so you should try to avoid an infection in the first place. The best defense is to avoid risky behavior such as running peer-to-peer (P2P) file sharing software and other "free" or "fun" downloads, clicking on popup windows, visiting un-trusted websites and opening e-mail attachments you can't identify.  Thinking of your computer as a car: don't drive around bad neighborhoods!

This page is maintained by the Office of Security and Access Management
E-mail: security@kent.edu
Phone: 330-672-5566
Fax:330-672-3253