IE10 downloading files has .exe become _exe

Question

I have a Windows 7 SP1 x86 machine with IE10, fully patched, which has strange issues with downloads in internet explorer. Specifically, any exe (as well as others) has the period/dot/full stop replaced with an underscore. As such, a download for foo.exe becomes foo_exe.

Attempting to download the file will initially fail with "This file couldn't be downloaded" and any attempt to cancel, open or exit the download prompt is ignored. Retrying the download will allow it to complete successfully.

Attempting to update to IE11 fails, with a log entry in C:\windows\IE11_main.log reporting that an attempt to download required files was unsuccessful.

Diagnostic steps:

• "Do not save encrypted files to disk" option is cleared (per KB2549423, applies to IE9, but has same symptoms)
• Checked operation under both Protected Mode for Internet Sites and with Protected Mode disabled
• Reset all IE settings
• Checked HTTP headers, Content-Length and Content-Type specifically
• Checked for addins, malware, etc... using Task Manager, MalwareBytes and autoruns
• Checked for network proxies, installed firewalls / security suites
• Checked for adequate free disk space
• Ran IE with add-ins disabled

Answer 1

Running a Process Monitor trace of the file download starting showed that the CreateFile calls to write to the Temporary Internet Files directory were failing with the error code of DELETE_PENDING. Process Monitor was filtered such that the Path contains the name of the file being downloaded.

Process Explorer showed open handles to the Temporary Internet Files directory opened by svchost running the Roaming Profiles service. Restarting the service released the handle, allowing IE to properly write the file.

No further issues with downloads were reported.

Answer 2

I was having this exact same issue and I figured out what caused it, in my case at least.

I had ran the CryptoPrevent tool from Foolish IT and one of it's options is to add a Group Policy to Block executables from running in Temporary Internet Files.

Once I undid this policy change and rebooted, IE 11 stopped swapping out the application.exe for an application_exe.

I just wanted to add this post since it was a solution in my case.

Answer 3

As Mitch answered,

It seems to be a bug (handle leak) of PcaSvc (Program Compatibility Assistant Service) which should be fixed with: Error message when you try to download a file by using Internet Explorer in Windows 7 SP1 or Windows Server 2008 R2 SP1.

The main reason of foo.exe becomes foo_exe is that CreateFile returns DELETE_PENDING for a delete pending folder stored in Content.IE5. For example C:\Users\USERNAME\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9I1B2791.

9I1B2791 is opened by svchost.exe. You can verify this by using Process Explorer or Handle Windows Sysinternals.

There are many svchost.exe processes launched. You can find svchost.exe hosting PcaSvc by running tasklist /svc.

Terminating the problematic svchost.exe releases leaked handles (and also the delete pending folder is removed then).

So after all you can download files correctly.

Answer 4

For me, in Internet Explorer 11, things were solved by uninstalling a program called Anti Logger SDK from a company called Zemana, followed by rebooting my computer.

Answer 5

We've found restoring defaults and resetting user settings in Internet Options Advanced Tab resolves this issue. Have yet to find out what is causing the problem.