net stop remcomsvc
"remcomsvc" is a component of the RemCom remote administration tool. While it has legitimate uses, seeing it unexpectedly is a strong indicator that a remote administrator (or a potential intruder) is executing commands on the system.
: It uses named pipes (standardly \pipe\RemCom_Communication ) for communication between the local console and the remote service.
Here are some best practices for using remcomsvc :
: Look for the creation of named pipes associated with RemCom communication.