L0rd_Byr0N

One of my Windows 2000 servers (running IIS to support ARCIMS application) was hit by L0rd_Byr0N. Instead of a page not found the http://(server name) gets their hacked message. Nothing has changed on this server for over a year. How did they get in (IRC) and more importantly what do they leave behind. Already someone came in behind them and setup a Serv-U FTP site. Having a hard time finding where they got in. Reformating the hard drive is not an option at this time. Any help on this would be appreciated.