Well, working at MS support I had a similar request once. Not saying it is you doing the same, but sou ask for stories like that, and this may shed some light.
I got a call promoted from an external support center running in india that did ASP support (and he made enough pressure it got promoted to processional support services SQL Server level 3 - the "last line of defence"). On a website, SQL Server would stop responding hitting a specific SQL Query. The Server would just stop doing anything, actually even IIS was not properly usable anymore. I got a full case documented from a very entusiastic fellow that even managed to proove it was something wrong with SQL Server because the (C++ level) stack traces showed the OleDB driver hanging in the call to SQL Server. First time in my life someone showed me that level of stack trace for prooving SQL Server crashed.
Anyhow, some research turned out - the programmer that originally wrote the site and had still been fired by the customer trying to fix the mess should not have been using ASP but serving burgers instead. Customer had that one particular page making a lot of compelx SQL calls - and the database had NO INDEX AT ALL. Basically it would go into "tying to make a dozen table scans" on a very cheap disc system. After adding even SOME indices, the system became usable - and the customer went to along quest of checking the whole complex database. The support person was obvsiouly a litle ashamed for not having checked what SQL Server was actually DOING (which would have resulted in awkward execution pland an stalled IO immediately).
And here the story comes back to you ;)
You say with a bad query, IIS stalls for minutes.
Can you validate that:
* This happens on IIS? Being making an example, and chcking in IIS and in Enterprise Manager? If it also hangs in Enterprise Manager - it it not IIS.
* It hangs IIS as in the app. Does the rest of IIS / other apps / static pages still work?
* The code does happen in a page, and not in a central element / event handler / synchronized connection so taht one hanging access hangs the whole app?
* What is IIS processor load and SQL Server load doing during that event?
* SQL Server does not happen to be on the same computer? (so it overloads the computer and thus also hits IIS)?
I can not really imagine this behavior without some issues in the IIS side.
Basicalle, give us a little more context and we should find it ;) Meanwhile, enjoy my story.