Like so many in the news, this client refused to update his Web Server software since "every time it would break more than it fixed." As painful as it may be to update your MS products, it's always more difficult and expensive to recover from relying on a broken system. There are so many secure systems on the market today, there's no reason to stick with one that you know is broken.
This client was compromised and defaced by attackers that knew MS vulnerabilities and exploited them to gain Administrator access to the Windows machines. The attackers then defaced the website and changed the administrator's password.
Solution -- The only solution in this case was to reinstall Windows and restore from backups. If this client hadn't made recent backups, this could possibly have been more expense than the company could bare.
For information and assistance on these or any other computer related issues, you can contact us by: E-Mail, or by calling 775/741-8278.