It occasionally asks for internet access when I’m not anywhere near my email. Sygate flagged its latest access as “major” in severity. the remote host was 88.24.87.54. Do I need to supply any more information, I can’t see anything else helpful in the log.
Well this IP is for rima-tde.net of TELEFONICA, S.A, Madrid.
Ring any bells (sorry couldn’t help myself) ?
Unfortunately Sygate is flawed (not to mention old and unsupported) in that it can’t identify what is using a localhost proxy, it can only identify the proxy (that of the internet mail provider, ashMaiSv.exe).
So any traffic using the email ports that the Internet mail provider monitors, 25 SMTP, 110 POP3, 119 NNTP or 143 IMAP would be redirected through the Internet Mail localhost proxy and all Sygate would see is the proxy parent not what is actually using it.
So it is possible that you have an undetected/hidden spambot sending out spam that is going through the localhost proxy. Set the Internet Mail [rovider sensitivity to High and that should identify too many identical emails in a time period.
I really do suggest you get a current firewall that can identify and challenge what is using the proxy rather than because the ashMaiSv.exe is an allowed process everything else using the proxy sails through unmolested by your firewall.
If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
- SUPERantispyware On-Demand only in free version.
- MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.