If you're talking the old-days, was that pre or post Code Red?  Because that was care of IIS.  Yeah, I had to admin an IIS server for a short while where I work, and it's just awful compared to Apache.  And IIS still likes to have a horrible zero-day every few months, though I don't know a great deal about it, particularly the newer versions because fair enough, the exploits seem to be all on IIS 6, which is outdated.