Ingreslock port 1524/1525 issue

Pwns Mastasurf at TF2
Retired Forum Staff
✔️ HL Verified
💻 Oldtimer
Dec 7, 2001
Best answers
Ok, since networking stuff is NOT something I know muchh about, I'll stick this one here. I periodically look at my netstat report if something seems to be going slow when I'm online. Today, I did one and found

Proto Local Address Foreign Adress Status
TCP home:ingreslock localhost:1525 Established
TCP home:1525 localhost:ingreslock Established

I've never heard of this ingreslock thing, googling got me a bunch of crap I didn't really get, so I'll stick it here. Since it appears to be only local, I'm not too worried, but still, never seen it before. Just wondering if I've been compromised or something? Anyone got any insight?

Lost in space
Oct 21, 2003
Best answers
If you're behind a router, having it listen on localhost means it's not accessible to the interweb (unless you have the port it's listening on forwarded to said comp).

If you don't see any strange processes running, check start->run->"services.msc" to see if it's running as a service.

From what I can see, it's either a) database daemon, or b) some kind of remote shell that you can telnet into, or c) some kind of installed trojan (honeynets report tons of scans on those 2 ports)

Users who are viewing this thread

Top Bottom