I get the following Event ID 16 in the System Log. I know that some script is trying to call the command prompt, but what ? The script started from the URL '/scripts/..%5c..%5cwinnt/system32/cmd.exe' with parameters '/c+ping+-n+50000+-l+65400+-w+499+216.202.193.83' has not responded within the configured timeout period. The HTTP server is terminating the script. Any help would be appreciated.

Your server is being attacked. Check out the MS site for IIS security updates and install them ASAP. If the attacker is successful, they will have command prompt admin control on your server. Very bad.

For the last couple of weeks, IUSR has been trying to log onto our server, too (yields Event ID 100). The account was probably noticed before I turned off IIS (since it's not a web server, after all). At first, I made sure that IUSR had no resource access, then decided to kill the account altogether. Attacks have not subsided - mostly at night, a little over once per hour. Without an account, how can IUSR possibly get in - and why does it keep trying? Thanks for all info.