This is more of a networking question than a programming question. There is a virus running amok on our network at work and it seems to be taking down our servers. I have determined that the virus spreads by creating svcctl pipes:
This signature detects requests to change the service configuration of a service on the remote system using the svcctl named pipe. The SCM Manager API provides functionality to create a new service, change the service configuration of a service, etc. The SCM Manager is exposed remotely via the named pipe svcctl. Thus, it is possible for a user to connect to the target system as a "Guest" user and change the configuration settings for the weak service using the named pipe svcctl.
Currently I have prevented my machine from getting re-infected by disabling my Server service. I was wondering if there was some way to set something in Group Policy to prevent this virus from creating dummy services on other computers? Unfortunately our networking staff aren't doing anything to rid our network of this virus.