A few ideas to try:
1. In IIS check the properties for the site, on the HomeDirectory tab check
what is selected for "Execute Permissions".
2. On the same tab click "Configuration" and verify that the file extension
".exe" is not mapped to anything.
3. Check log file in C:\WINDOWS\system32\LogFiles\HTTPERR for possible
explanation of the error
You may also find something useful here:
Development Impacts of Security Changes in Windows Server 2003
Secure Windows Initiative
June 16, 2003