If your not sure ask your host what your sites are running on. Some time back there was a hack on a MS box (roughly 1 year ago) for paths. Believe it or not some hosts forget to run an IIS lockdown tool.
http://searchsecurity.techtarget.com...134252,00.html