Ject/Scob Attack: IWAP_WWW account on IIS servers
http://www.incidents.org/diary.php?date=2004-06-28
We have received information about compromised systems with Internet Information Server. These systems had an administrator level account with the username IWAP_WWW added. Please check if your server has such an account and let us know what you find. Until we know more, we suggest that you consider a server compromised if you find and administrator account with this username.