Secure? computer infected by Trojan

[mdforchildren]

A webserver running IIS 4 with the Microsoft Lockdown utility and URL Scan, which is presumably secure became infected with the bat/ircflood trojan. Fortunately, a realtime virus scanner caught and deleted the trojan, but we are hoping to find out how the computer became infected in the first place (trojan found in winnt\system32). The IIS logs didn't show anything, and neither did the URL Scan, FTP, and event logs. The only access to the computer is through

http://WWW and

several users with FTP access. We do have an adminstrative share on the winnt folder and a web application which must use some files under the winnt folder (presumably DLLs).
If anyone has any suggestions as to where to look to determine how someone got in and infected the computer it would be greatly appreciated.

 

[FaiTHLeSS]

From the virus info on symantec site

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.ratsou.b.html

Sounds like someone with access has downloaded it or uploaded it via FTP. Or someone has gained access to your server.