.htaccess dosen't work on IIS.
There may be an option to ban by IP in the IIS configuration (I doubt it). Your other options include;
Make all your pages dynamic - (set html to be run through asp). Include at the very first point in the page a little security call that checks against your list - if banned prints 404 or something.
Or move to apache - NT + 98 versions are available.
Others more familiar with IIS maybe able to provide some more options. Good luck.
[iisadministrator.com...]