Hi Len,
The entire web site must have read permissions for the user that is the idnetity on th eapplicaiton pool and write permissiosn for the same user on /Data and /App_Data
Usually it is a different user ie the ftp user that is used to upload files and this is not the same as the user on the application pool that the site executes as. Usually the ftp user has full permissions so that you can upload files.
If you want to upgrade to the latest version, I would upgrade first keeping it as .NET 3.5, then change to a .NET 4 app pool and upload the .NET 4 version of mojoPortal. The Web.config file is different for .NET 4 so once you switch you need to use the one in the .NET 4 package and resotre any customizations such as your machine key.
If you are moving to a different database you need to get a backup of the db and restore it on the new database server.
See:
Note that our packages for MS SQL are already pre-configured for medium trust so you don't have to do anything special to handle that.
Hope that helps,
Joe