What actually happened, as we mentioned earlier, was that Microsoft removed the redirect from windowsupdate.com to windowsupdate.microsoft.com, thus cunningly frustrating the worm, which was written with a view to performing a denial of service operation on the former, but not the latter. The BRS approach to security, which owes much to the theory that viruses don't come out at night, is one we particularly like, as it's cheap and approximately 50 per cent effective, but the move did not make Windows Update unavailable as such.
In the absence of windowsupdate.com the first stop of incoming requests was the Akamai caching service which Microsoft uses. This runs on Linux, hence Netcraft report a Linux host, but behind this the Microsoft servers were still operational, hence the report of Microsoft IIS running on Linux. So Microsoft isn't running Windows Update on Linux, and although it's using a service provider that runs on Linux, those services are still fielding back to Windows 2003 servers, clear?
Now, watch the various USENET groups and blogs report "Windows Update on Linux" as fact....