Dear Pavel,
Thanks, for the reply. I already using the Process Monitor with exact steps and I found many spam scripts and removed it from the server, using the following source as you told me.
How to identify source / script of spam IIS 7
but process monitor eats virtual memory very fast and...