IMO this is much less a DNN issue as it is a general ASP.NET issue. Forgive me if i was not clear.
The point is that IIS spawns a process that is running .NET code (this process is called aspnet_wp.exe on windows XP, and w3wp.exe on Windows Server 2003 and Vista). That user used to run that process is called NETWORK SERVICE by default on windows Server and Vista, and ASPNET on windows xp. Because of DNN requirements, this user needs to have write access to the root of the DNN install and everything below.
Apart from the user account for the asp.net worker process, IIS also uses a different account to access all files for anonymous users (asp.net AND non asp.net files (such as images, javascript, html, etc) This user is called IUSR_[MachineName] by default (on windows server 2003 and xp, not sure about vista). This user account should have read rights to all files.
I noticed that on windows xp at least, anonymous access to a new virtual directory can be turned off by default. This is OK if you only use IE on the local machine to view the file, because IE will (by default), pass your user credentials to IIS, which means that you will not browse the site as anonymous user. In FF you will see a popup logon screen.
Please check this microsoft documentation for more information: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/d8db0056-d352-48f9-bfac-bb3e932f1810.mspx?mfr=true