I try 3.0 SR1 and have this problem.
I have a suggetion (and bad english :).
1. MD first try connect to proxy unathorised, then it closed this port (TCP) because of 407;
2. Opens next port (number +1) and send HTTP request with NTLM (phase 1 in NTLM chalenge/response). Gets reply with NTLM response and _close_ this port.
3. Open next port and send second NTLM (phase 2) signed HTTP request, but ISA wait on _new_ connection for fisrt NTLM (1 phase) - and of couse MD receive 407 Proxy Authentication Required.
Is this a feature or bug?
Why not try all communication with proxy over one (1) connection (for one download tread) as IE does?