Many, but not all of my accounts on Win2 have had a file, “lord.htm” uploaded to the root server (not site) directory. the date of the file is the same, August 23, 2006. In some accounts, miscelaneous .axu files were uploaded on the same date.
No damage or defacement was done on any of the sites, but since this is very reminiscent of the recent attacks on Jodohost’s web servers, I thought folks ought to be alerted.
if you can let me know the account these were in I can give you the attack vector 
Windows is isolated only to the users fodler for any hack, so any domains under one user with a vulnerable joomla, phpbb, or other script can have all sites under that user defaced.
If yu can let me know the user, I can look in the logs and tell you how they did it and you can close the hole.
User IDs sent via PM
Replied thanks for the info