Summary An attempt was made to run a program in the system32 directory from the IIS server. In many cases, this will not immediately give the intruder full control over the system. Alternately, the intruder may decide to upload hacking tools and DDoS zombies to the system. This will give the intruder a base to launch attacks against other systems.
Action Look at the return code associated with the attack.
If the return code is 502, then there is a good chance the system has been compromised. In contrast, if the return code is 403 or 404, then the system is unlikely to be compromised. Make sure you have installed the patch described in Microsoft Security Bulletin MS00-057 from August, 2000. This patch, released in August, will fix the primary exploit against this vulnerabiliy. The HTTP return code.