This appears to be similar to the SDL HTTP 401.1 error message might occur when accessing Template Builder Custom Page Knowledgebase article in which it recommends using 'Anonymous Authentication'.
There are a couple things that you could check on top of what you have listed....
1.Check that the 'Client' folder also has just 'Anonymous Authentication' enabled.
2.If using LDAP, the online documentation (login required) is quite insistent that only 'Anonymous Authentication' enabled for the Client folder, so ensure that this is the case.
Select the virtual directory called ImportExportService\Client and enable Anonymous Authentication (and disable all others).
3.Make sure that the 'Client' folder itself has the security configured to allow the files to be read by anonymous users
I assume that you have already disabled the lookback checkdisabled the lookback check if your Tridion URL is different than your machine name.
[UPDATE] It may also be worth checking that the Tridion CME site is in the correct 'Zone' in Internet Explorer and that the browser is configured correctly, as there are a few Internet Explorer settings that affect ClickOnce:
- Script Activation
- Disable ClickOnce MIME Handler
- Disable Managed Code