IE10 downloading files has .exe become _exe

Running a Process Monitor trace of the file download starting showed that the CreateFile calls to write to the Temporary Internet Files directory were failing with the error code of DELETE_PENDING. Process Monitor was filtered such that the Path contains the name of the file being downloaded.

Process Explorer showed open handles to the Temporary Internet Files directory opened by svchost running the Roaming Profiles service. Restarting the service released the handle, allowing IE to properly write the file.

No further issues with downloads were reported.

I was having this exact same issue and I figured out what caused it, in my case at least.

I had ran the CryptoPrevent tool from Foolish IT and one of it's options is to add a Group Policy to Block executables from running in Temporary Internet Files.

Once I undid this policy change and rebooted, IE 11 stopped swapping out the application.exe for an application_exe.

I just wanted to add this post since it was a solution in my case.

As Mitch answered,

It seems to be a bug (handle leak) of PcaSvc (Program Compatibility Assistant Service) which should be fixed with: Error message when you try to download a file by using Internet Explorer in Windows 7 SP1 or Windows Server 2008 R2 SP1.

The main reason of foo.exe becomes foo_exe is that CreateFile returns DELETE_PENDING for a delete pending folder stored in Content.IE5. For example C:\Users\USERNAME\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9I1B2791.

9I1B2791 is opened by svchost.exe. You can verify this by using Process Explorer or Handle Windows Sysinternals.

There are many svchost.exe processes launched. You can find svchost.exe hosting PcaSvc by running tasklist /svc.

Terminating the problematic svchost.exe releases leaked handles (and also the delete pending folder is removed then).

So after all you can download files correctly.