Looks like SANS (http://isc.incidents.org) is receiving reports of other
compromised IIS servers. Might want to check your servers.

Handlers Diary June 28th 2004
Updated June 28th 2004 13:53 UTC (Handler: Jim Clausing)
IWAP_WWW account on compromised IIS servers
Request for Information: IWAP_WWW account

We have received information about compromised systems with Internet
Information Server. These systems had an administrator level account with
the username 'IWAP_WWW' added.

Please check if your server has such an account and let us know what you
find. Until we know more, we suggest that you consider a server compromised
if you find and administrator account with this username.

-------------------------------------------------------------------
Johannes Ullrich, jullrich_at_sans.org

[ Post a follow-up to this message ]