By design, ASP.NET requires read, execute, and list access for the ASPNET account (the Aspnet_wp.exe process account) on the root Web site or on any virtual directory.
See http://support.microsoft.com/default.aspx?scid=kb;en-us;Q316721 for more information.