ASP Problem hacker related

I found these in my window's logfile
15:34:15 66.221.204.1 HEAD / 403
16:03:39 66.221.204.1 HEAD / 403
16:03:52 66.221.204.1 HEAD / 403

Now my registration form isn't working.

I believe someone loaded sort of scripts to my server and it altered something in my program.

I use IIS 5.1 with Windows XP Pro.

The registration form is blocking ppl register by saying "User name is already exist, please enter a new user name"

The error page keeps pop up even I removed that username validation line in my program.
All I get is "Http://www.mysitename.com/register.asp?ExistUserName=True"

This is not an ordinary syntax error cuz the program has been working for several month (since the date I created this form) I even get user registered yesterday. Now it stopped working today.

Could someone help? Thx.

Well it's not the HEAD / you should be worried about. That is a legal HTTP instruction, just Like GET or POST.
It's what is not in your logs that should worry you.
Check out your asp code again, make sure it's not been altered, and the same goes for the database.
Then get a trojan/virus scanner (to be on the safe side) and do a heuristic scan of your computer.
Then have a surf over at www.securityfocus.com and patch your IIS, there are a number of IIS bugs, although, the security issue at hand could just as well be caused by sql injection or unsafe redirecitions or piping. You might want to look at their article section for ASP safety good programming practices, and make sure your forms meet them.

Hi,

I reformatted my HD on my server. I reinstalled everything including XP and IIS 5.1.
I tried to copy all my webfiles (ASP) from my backup CD to my newly setup server.
Some of the pages get redirected to "Http://www.perfectnav.com/....uid=...... " even the ASP file is in my webroot folder.
I also found DeskTop.ini in my webroot as well as in my Server Extension Bin folder, system32 folder, etc.

How can I fix the problem?

BTW, someone told me that it's normal to find DeskTop.ini in my machine.

Here is the content of DeskTop.ini in my webroot
[.ShellClassInfo]
IconFile=_vti_pvt/fpdbw.ico
IconIndex=0
ConfirmFileOp=0
InfoTip=Stores your local web site