NT web server IIS 4.0 comes configured with an anonymous FTP user and the ability for users to change their password through the web interface.

SOLUTION:

Using the IIS 4.0 MMC tool, right-click on each of the IIS* webs and chose Delete.

The MMC (Microsoft Management Console) is located at: Start, Programs, Windows NT 4.0 Option Pack, Microsoft Internet Information Server, Internet Service Manager.

MS Knowledge Base article
Microsoft suggested security check list