1) block the IP attempting this
2) Have some type of IDS (intrusion detection system) to monitor and automatically block 'bot' type attacks. If possible
3) Look at deploying urlscan 3.0 to help deny these attacks. The real way to prevent being zapped is trust no user data input and validate everything.
Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield
http://www.IISLogs.com
Log archival solution
Install, Configure, Forget