More detail - from the IIS logs... (I've replaced the text 192.168.1.128 Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.832) with XXX and the text W3SVC1013099565 with YY for brevity)
2007-11-22 16:03:21 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 2 2148074254
2007-11-22 16:03:21 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 1 0
2007-11-22 16:03:21 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 VIRTUAL\Administrator XXX 200 0 0
2007-11-22 16:03:22 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 2 2148074254
2007-11-22 16:03:22 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 1 0
2007-11-22 16:03:27 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 VIRTUAL\Administrator XXX 200 0 0
2007-11-22 16:03:27 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 2 2148074254
2007-11-22 16:03:27 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 1 0
2007-11-22 16:03:27 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 VIRTUAL\Administrator XXX 200 0 0
2007-11-22 16:03:27 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 2 2148074254
2007-11-22 16:03:27 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 - XXX 401 1 0
2007-11-22 16:03:28 YY 192.168.1.128 POST /_vti_bin/K2SPLists.asmx - 80 VIRTUAL\Administrator XXX 200 0 0
2007-11-22 16:03:29 YY 192.168.1.128 POST /_vti_bin/K2SPContentTypes.asmx - 80 - XXX 401 2 2148074254
2007-11-22 16:03:29 YY 192.168.1.128 POST /_vti_bin/K2SPContentTypes.asmx - 80 - XXX 401 1 0
2007-11-22 16:03:29 YY 192.168.1.128 POST /_vti_bin/K2SPContentTypes.asmx - 80 VIRTUAL\Administrator XXX 200 0 0
2007-11-22 16:03:31 YY 192.168.1.128 POST /_vti_bin/K2SPFeatures.asmx - 80 - XXX 401 2 2148074254
2007-11-22 16:03:31 YY 192.168.1.128 POST /_vti_bin/K2SPFeatures.asmx - 80 - XXX 401 1 0
2007-11-22 16:03:32 YY 192.168.1.128 POST /_vti_bin/K2SPFeatures.asmx - 80 VIRTUAL\Administrator XXX 500 0 0
I don't know why each service is being called 3 times and refused twice, but the third time normally works, except at the end where you can see the HTTP 500 error