My 2c

1. IIS7/7.5 use app pool isolation by default fo IIS AppPool\DefaultAppPool is the default user for the application pool. If you have a different app pool name (e.g. "cathal") the user would be IIS AppPool\Cathal - you can read more on Microsofts logic at http://www.dotnetnuke.com/Resources/B... . However many hosts choose to change the user the application pool works under back to network service (as it's easier to grant permissions to "real" users rather than virtual users) or to create a new user and apply it to the application pool. Irregardless, whatever account the application pool works under needs modify permissions from the root down.

2.you do not need IIS_IUSRS permissions as that is for out of bound processes (e.g. classic asp/cgi-bin/perl). AFAIR you do need the IUSR user (list/read permissions) as that is the account that initially loads the page from the file system before determining that it has a .net extension and passing it to asp.net for processing - there are some perculiarties about this (http://serverfault.com/a/184778 covers them well) -please note, as the IUSR user is a member of the all users group it often will already have the necessary permissions.

Finally, I would suggest that you check and ensure that the web.config is not set as read-only as that will also stop file writes - if you've copied the files via FTP the readonly bit will be automatically cleared - however some hosts support deploying code from within their infrastructure and an internal network copy can maintain the readonly bit - however I would very much doubt this would happen , it's much probable if you were hosting your own server.