It looks like it's just a dos shell launcher of some kind. I will have to keep an eye on the forum more often. One of our dev servers got hit with that too 2 weeks ago. It exploits the web server folder transveral vulnerability. This happens for all users.
Passwords policy is to never expire.
This will solve some of it. I, too, was hit by this hack. By default it is turned on and allows anonymous access. Turn it off if it's on. I turned mine of and applied the security patches found on the MS web site for IIS 4.0 and have been OK since.