Hi,
It sounds like you have basic or digest authentication enabled on the directory where the files are uploading when it should only have windows and anonymous authentication enabled.
I would also make sure the App_Data folder is writable by the web process.
Hope it helps,
Joe