Hi,
I'm no expert, I'm struggling myself with security issues etc. However, here are some things I've been through:
1) if you're using both .Net 1.1 and .Net 2.0 you'll need to set up a separate App Pool. You can't run both versions in a single App Pool.
2) check your web.config settings. The authentication mode section it should make sense with the Directory Security and impersonation settings you've got for the website/virtual directory.
That's all I can think of right now. Sounds like you've recently upgraded. I'm not sure what it means to run .NET framework 2.0 in IIS 5. I'd suggest upgrading.
Good luck
Lou