Penetration Testing: finding webroot on IIS

[* (todd + 1) <todd () ubermother net>]

hello all,

Recently i came across an IIS webserver that i found to be vulnerable to the 
Unicode attacks. However, i cannot determine the webroot of this drive, and 
therefore i am having troubles reaching a full comprimise.  The directory 
"C:\Inetpub" exists, but the only contents of this directory is the folder 
"mailroot".

Additionally, when i connect and request the root document (ie GET / ), it 
returns the string: "<% Response.ContentType = "text/plain" %> HELLO"

Does anyone come across anything like this before, and what would be the 
simplest method of determining the webroot?

thanks in advance
todd willey
ubermother