Portability: Apache runs on ANYTHING out there. IIS runs only on Windows. Winner: Apache
Security: Apache has had something like one remote root explotable bug in the last 3 or 4 years. Patches to fix a major remote root exploit against IIS or one of it's component parts come out about once every three or four months. Winner: Apache
Stability: Apache is one of the most rock solid stable pieces of software I've ever used. IIS, not so much. Winnder: Apache
Performance: Apache 2.x removes any advantage IIS once enjoyed on the Windows platform. You can configure it to be as light weight or as featurefull as you want. Plus, if you're running it on windows and need more performance, you can migrate your apache box to a 64 CPU Sun E10k running BSD, Linux, or Solaris. IIS is a good performer up to a point, but tends to collapse under load if not carefully setup to handle said load. Winner: Apache
Market lockin / sneaky tricks: Apache is open source, and the fixes for security flaws tend to show up in <24 hours from the time of their discovery. IIS is developed by a company with no apparent moral compass, who will gladly throw you and any other customer to the wolves should it provide them with a short term profit. Winner: Microsoft (i.e. more trick, less trustworthy...)