Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is more of a networking question than a programming question. There is a virus running amok on our network at work and it seems to be taking down our servers. I have determined that the virus spreads by creating svcctl pipes:

This signature detects requests to change the service configuration of a service on the remote system using the svcctl named pipe. The SCM Manager API provides functionality to create a new service, change the service configuration of a service, etc. The SCM Manager is exposed remotely via the named pipe svcctl. Thus, it is possible for a user to connect to the target system as a "Guest" user and change the configuration settings for the weak service using the named pipe svcctl.

Currently I have prevented my machine from getting re-infected by disabling my Server service. I was wondering if there was some way to set something in Group Policy to prevent this virus from creating dummy services on other computers? Unfortunately our networking staff aren't doing anything to rid our network of this virus.

share|improve this question

migrated from Mar 11 '11 at 21:06

This question came from our site for professional and enthusiast programmers.

I'd be surprised if there's any method to prevent remote access to the SVCCTL pipe. I'm not finding any documentation that suggests there is a way to do so.

I'd consider auditing your service ACLs and tightening them up with the sdset functionality of the sc command or forcing out better service ACLs using Group Policy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.