Mofei worm and login attempts

[Sarah H]

We have a computer on our network that was infected with the Mofei
worm. While it was infected, several accounts (many of them high-level
or administrative) got locked out by incorrect login attempts from
that machine. I know that the Mofei worm will try to access the
"administrator" account, but these 15 accounts all had very different
names. Does anyone know of the Mofei worm (also sometimes known as
Femot) behaving in this way? Can it get a list of account names to
try?

 

[Greg]

Not familiar with that particular critter, but yes, there is a way to
enumerate accounts (null-session exploit, I believe)

Greg