If you have an IIS running, just patch it, if necessary. If you don't, laugh at them. It might be hard to believe, but script kiddies are able to keep using dozens of unicode strings to 'own' an Apache server.. Argh. And defacers dare to call themselves hackers. Yuck!
Another possibility is Nimda or Codered, as it was previously stated. See? Worms are already smarter than script kiddies!