That does appear to be what it does...
While some people think it's only fair, it's of dubious legality since you're using the same exploit against them - It's better to just continue letting them fail, knowing that you won't be affected other than the relatively minor bandwidth consumption. If you redirect them, why not redirect them to a bandwidth-sucker of a web page, such as www.microsoft.com

By the way, what it's doing is redirecting them to the exploit on their local machine, then calling the rundll32 executable to use a function in the specified DLL file that's called when the box logs itself out or reboots. I don't know exactly what happens when you try to log out a service, though - I wonder if it even works. Plus this will only work on an NT/2000 machine that has %systemroot% at C:\WINNT (although it does by default).