There was a thread about a security issue with phpvms, I can't find it. Here is how you change your .hta file.
# prevent viewing of a specific file
RewriteEngine on
RewriteCond %{HTTP_HOST} ^YOURURL.com$ [OR]
RewriteCond %{HTTP_HOST} ^www.YOURURL.com$
<FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh|tpl)$">
Order Allow,Deny
Deny from all
</FilesMatch>
#custom error docs if you have them
#ErrorDocument 404 /404.html
#ErrorDocument 403 /403.html
#disable hotlinking
RewriteEngine on
#disable some known attacks from agents also hotlinking
RewriteCond %{HTTP_USER_AGENT} libwww [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)=http [NC]
RewriteRule ^(.*)$ – [F,L]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?YOURURL.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?forum.phpvms.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?va-list.com/.*$ [NC]
RewriteRule \.(gif|png|jpg|js|css)$ - [F,NC]
#disable display of dir structure
Options -Indexes
Change the YOURURL to the url of your VA.