http://googleonlinesecurity.blogspot.com/2007/06/web-server-software-and-malware.html

apache vs. iis