Get a router. You are a sitting duck with out one. I got hacked 3 times in 2 weeks, had to reformat and re install all 3 times. I don't care what they (Microsoft, or anyone else who *thinks* they know what they are talking about(sorry to sound so rude)) says, the only way to keep your server safe (especially with IIS) is to disconnect it from the internet all together, unless you get a router.
A router, another box (not a Windows box, a *nix box) used as a firewall, or something, or you are just saying "Come right on in and mess my system up! Free coffee and BAWLS for all who attend!" (BAWLS is a cafinated beverage popular among hackers and gamers).
Look, I implemented everything I could find from securityfocus.org, Microsoft's website, other forums, this forum--the first time I got hacked. Then not 2 days later (I remained disconnected from the internet until it was all done), I got hacked again---and again. The only thing I dind't do was get a router, which was the first thing suggested to my by an associate. Nah, I had to be cheap about it, and think I knew more than the hackers. Ha! Look what happened.
Moral of the story? Get a router. It's the cheapest and easiest way to protect yourself. Your server will still work just fine, because most routers are highly configurable (I have a server running behind my router, it was a snap to set up). I got one of those Linksys 4 port jobs, and it was the best 80 bucks I ever spent. Now, *I* can't even hack my own system (mainly because I have "Remote Administation" disabled).
Good luck, I hope you get something in there soon. Scirpt kiddies have a stiffy for our systems (2000 and XP because of full Unix porting). Our boxes are the most perfect thing to put Sub7 Trojans on to carry out a balistic DoS attack. Without a router, or external firewall, your box can be turned into a trojan supernode. Do something, and do it fast.

Hope I was of some help...
--OR--
Thanks for the help...
--Rich