Backdoor.Ingreslock Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 2 |
| First Seen: | December 28, 2015 |
| Last Seen: | August 17, 2020 |
| OS(es) Affected: | Windows |
Backdoor.Ingreslock is an old vulnerability that was first reported in 2004. Backdoor.Ingreslock is a backdoor exploit that allows a third-party to gain access to the affected computer. Backdoor.Ingreslock has received recent attention because of Google Chrome notifications indicating the presence of Backdoor.Ingreslock in its memory processes. Even thought the original versions of Backdoor.Ingreslock are no longer active, certain Trojans may use similar vulnerabilities to infect computers, which may be a cause for concern if a computer is at risk or shows signs of these kinds of backdoor infections.
Table of Contents
Backdoor.Ingreslock and Similar Backdoor Trojans
Backdoor.Ingreslock exploits a specific vulnerability in a computer. Using Backdoor.Ingreslock, an attacker may gain immediate access to the affected computer, with privileges that would allow the attacker to collect data or carry out other operations. Backdoor.Ingreslock refers to the Ingreslock port (1524/TCP), which may be used by certain programs to exploit RPC (Remote Procedure Call), services. Backdoor.Ingreslock may be recognized by a file called /tmp/bob, which is the common configuration file used by these infections. Vulnerabilities associated with Backdoor.Ingreslock have been patched in modern operating systems. Computer users that have fully updated software and a reliable firewall have nothing to worry about when it comes to Backdoor.Ingreslock itself. If the affected computer is unpatched, however, Trojan horses associated with Backdoor.Ingreslock may exploit this vulnerability to execute corrupted code and download and install threatening software such as ransomware, worms and similar threats.
Dealing with Backdoor.Ingreslock
The Backdoor.Ingreslock vulnerability can be removed easily, although Backdoor.Ingreslock may be a symptom of a larger problem. However, good security practices and regular scans for vulnerabilities can root out problems like Backdoor.Ingreslock. It is advised to check the source of the potential attack, which may include an attack website or a third-party intending to gaining access to the specific computer.
Backdoor.Ingreslock and Google Chrome
In 2015, computer users have reported that local ports being used by Google Chrome may show up as 'Ingreslock' and 'PPTP,' even if the affected computer does not have components that would make legitimate use of the port linked to this component. There is concern that these notifications may be associated with Trojans that are using this old vulnerability to attack computers. The 'PPTP' message (Point to Point Tunneling Protocol) is also of concern since it may be linked to virtual private networks or VPNs, which may be used as a way of transmitting data to and from an affected computer anonymously.
It is possible that this is a glitch in TCPView, used to view a port activity, rather than an actual attack. In either situation, it is a good idea to run a full scan of compromised PCs with a reliable, fully updated anti-malware application. Backdoor.Ingreslock is quite an old infection that is rarely active now. If Backdoor.Ingreslock is appearing when its users are viewing active ports on their computers, it is more likely that the ports are being mislabeled due to a glitch than the presence of an actual threat issue.
Better Safe Than Sorry
When dealing with possible Trojan infections, the adage is true; it is better to take every precaution. A reliable firewall that is set to block traffic that may be associated with Backdoor.Ingreslock should avoid many problems. A strong program that is fully up-to-date and regular check-ups also may prevent these issues from occurring on affected computers. Safe browsing practices and keeping all software fully updated and patched should stop any possible infections similar to Backdoor.Ingreslock.
Submit Comment
Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.