It's one of the recent IIS viruses trying to escape from the server root,
run cmd.exe (NT's version of command.com (DOS) or /bin/sh (Unix)), and get
a directory listing ("cmd.exe /c dir") in preparation for further cracking.
This is not because your server is infected, it's because someone else's is.