yeah you will see servu running but usually hackers will change his name to some system process to be unnoticed the favourite is winmgmt... why? becouse there is a tutorial about hacking iis andd it sais to change your servu to this name... well some idiot script kiddies got typos and call it winmgNt...

anyway i will noticed that something wrong becouse my 56k would get even slower

anyway i got _vti_inf.html but didnt found service.pwd
also tried that blank login but it wasnt succesful due to the fact that i couldnt find in ms frontpage 2000 somwhere something that conected to remote authoring...

you said you modified your friends main page well can you tell me please where is this option is hiding?