>>>Has anyone been having their IIS web sites turned off because of an attempt
>>>to access the SCRIPTS directory. After we were hacked we removed this
>>>directory. But this apparently causes the websites to be halted.
>>
>>http://support.microsoft.com/support/kb/articles/q300/9/72.asp
>
>Does this also apply to NT 4.0?

I just got off the phone with an MS tech. He says its a worm called RedWorm. It shuts off the websites at some specified interval. At 12:00 midnight it will send 400 megs of data every 4 hours.

Anyone know of a fix for this worm?