Stephen, I still haven’t gotten a response to the help ticket. Is there any news on this issue?
I am still working on it, I have some time deadlines for things that I can’t really get into details on. I am having some issues in that and some servers have been a bit wild here this week keeping me distracted.
My local help is a bit 8o this week and next as well, as you may understand 
I did somewhat update in another thread, that I am using a new server that will be launched with php 5.3 for the testbed.
So far I have found there are some limited cases it can read files on users that have network service to have all permissions(modify+), (this is bascailly like 777 on unix in many ways)
It looks like on win1, a similar file was used on it.
I think the solution is harder however, as some asp.net apps simply ‘require’ network service to have full access, that is what I am trying to resolve now. Network service is what the app pools runs as, and although the user is locked to the IUSR account for their domain only, network service permissions apply at times. due to this, making all different app pools, doesn’t do any good either, unless the app pool user for each was changed. This would be a fundamental overhaul of hsphere and all servers, and really going to impact performance in a BAD way.
I am still trying to find other ways this can be fully stopped, without making sacrifices like features disabled.
I finally got a response from the help desk which referred me here so I will continue to ask questions here, I guess.
Do you think this script targeted HSphere? The password to the script seemed like it might be HSphere related.
My main concern at this point is how it got into my web directory. I looked through the logs and didn’t see anything that looked like it was out of the ordinary. The FTP password was 9 character randomly generated so it was not easy to guess though not impossible. If it was a script vulnerability on the site I would like to correct it.
I checked others and they mostly came via FTP, Frontpage, and FCKEditor, and other command galleries, and asp apps, but some from php as well. I didn’t check yours for that at this time, I will see about that.
On one server, I found frontpage brute force main cause(I believe it was 27 to 33 such files coming in on that server via FP, this happened some weeks back). Many people having weak passes. but randomly I have seen it MANY times now across the board due to fckeditors sample connectors that allow upload with no password, no auth of accounting of any kind, and very bad.