How to harden SEP after sexy.exe virus attack

Hi all and thank you in advance for your help and knowledge,

So Friday after noon our network was hit with the sexy.exe virus as a result our fileshares quickly tuned into directorys full of files with .exe extensions (some real file names with .exe added) and other with sexy.exe porn.exe and gueopo.exe.

We are running Symantec Endpoint Protection 11 and I was wondering if there are any know ports or sites that should be blacklisted? I have done some searching and have been unsucessful. Would love to get this going before the servers start going live.

I figured the good people at symantec could stear me in the right direction.

Thank you

Mike