SQL Bloke - SQL Server DBA

I have been doing some consulting for a small company with 60 sites each site has a system running either MSDE or SQL Express 2005. Now you are not going to believe this but the login for the application to the MSDE is SA and the Password is blank but worse still all this inofrmation is stored in an ini file makes me really worried. All this computers are open to the internet and currently i have been assisting in setting them up on a version of my basic log shipping.

Now guys we all know that leaving a blank password around is dangerous, storing it in an ini file is just as bad and using the SA account is worse still. Security one day people will wake up and smell the roses because they have been buried in manure.