Case of the IE9 .Partial Download Fail

One of the features many people (me included) had been requesting from IE for a long time was a download manager. IE9 has one, and it is nice when it works. But myself and others I’ve spoken with have had an abnormally high rate of downloads failing, usually it seems at the point the file should have finished downloading:


Also in some cases when this occurs clicking Open Containing Folder does nothing:


The file is left as a .partial file extension. Renaming it to the correct extension and it is still usable.

Loaded up ProcMon (http://live.sysinternals.com/ProcMon.exe) and added filter:


Then I re-kicked off the download


Download progress went to 98% then immediately to this. When this problem occurs for a download it occurs every time the particular file is downloaded.:


Looking at the ProcMon log we see initially the file is downloaded to

%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\

We can also see InoRT.exe the Virus Scanner at work on the file.


Eventually it writes file into the download location as .partial file


We then see where it updates the NTFS stream of the file :Zone.Identifier followed by a SHARING VIOLATION error.


As a side note – if you want to view the NTFS stream just specify the filename and open using notepad i.e.

notepad Reflector7_0_1_1.zip.jsopacn.partial:Zone.Identifier

In any case with the Anti-Virus going crazy over the .partial file, temporarily disabled the Anti-Virus and downloads worked perfectly.

But what about other browsers that use download managers? I tried Firefox 4 … same issue (Note: FireFox 3.x not affected. It seems in earlier versions of FireFox a zero byte .zip file is created at same time as the .zip.part file, when this occurs the download is successful. In FireFox 4 the .zip file only gets created at end of download) FireFox downloads with a .part extension then when download is complete renames to correct file. In this case Download got close to completion then suddenly failed, same as IE9. The only difference is with FireFox if I re-download the file and leave the temporary files there from the 1st download the file will download OK. IE9 re-downloading the file the problem always reoccurs.


ProcMon log looked very similar:


However Google chrome the download worked fine. Google downloads file with .crdownload extension then renames to correct file extension.


So here we find something important:

  • At least two web browsers are affected by the issue
  • Affected PCs issue goes away with Disabling Anti-virus (not something you really want to do when downloading files from the internet)
  • At least one web browser is not affected by the issue
  • Further testing seemed this mostly occurred with .zip files, but not direct .exe files
  • Tested with a different Anti-Virus – Microsoft Security Essentials and the problem did not occur

So while the anti-virus product (in this case CA eTrust) is partially to blame, What is different between the other browsers and Google chrome?

Using ProcMon documented the differences between the final stages of file write (starting from the last WriteFile Event)

IE9

FireFox

Chrome

WriteFile
Reflector.zip.partial

WriteFile
Reflector.zip.part

WriteFile
Reflector.zip.crdownload

QueryBasicInformationFile
Reflector.zip.partial

CloseFile
Reflector.zip.part

CloseFile
Reflector.zip.crdownload

CloseFile
Reflector.zip.partial

QueryOpen
Reflector.zip

QueryOpen
Reflector.zip

QueryOpen
Reflector.zip.partial

QueryDirectory
Reflector.zip

QueryDirectory
Reflector.zip.crdownload

QueryOpen
Reflector.zip.partial

QueryOpen
Reflector.zip.part

CreateFile
Reflector.zip.crdownload

CreateFile
Reflector.zip.partial:ZONE.IDENTIFIER

QueryDirectory
Reflector.zip.part

QueryAttributeTagFile
Reflector.zip.crdownload

LockFile
Reflector.zip.partial:ZONE.IDENTIFIER

QueryOpen
Reflector.zip

QueryBasicInformationFile
Reflector.zip.crdownload

QueryStandardInformation
Reflector.zip.partial:ZONE.IDENTIFIER

CreateFile
Reflector.zip

SetRenameInformationFile
Reflector.zip.crdownload

ReadFile
Reflector.zip.partial:ZONE.IDENTIFIER

QueryAttributeTagFile
Reflector.zip

CloseFile
Reflector.zip

WriteFile
Reflector.zip.partial:ZONE.IDENTIFIER

SetDispositionInformationCreateFile
Reflector.zip

   

SetEndOfFileInformationFile
Reflector.zip.partial:ZONE.IDENTIFIER

CloseFile
Reflector.zip

   

UnlockFileSingle
Reflector.zip.partial:ZONE.IDENTIFIER

QueryOpen
Reflector.zip.part

   

CreateFile
Reflector.zip.partial
SHARING VIOLATION

CreateFile
Reflector.zip.part

   

   

CloseFile
Reflector.zip.part

   

   

CreateFile
Reflector.zip.part

   

   

CloseFile
Reflector.zip.part

   

   

CreateFile
Reflector.zip.part

   

   

DeviceIOControl
Reflector.zip.part
INVALID PARAMETER

   

   

CloseFile
Reflector.zip.part

   

   

CreateFile
Reflector.zip.part
NAME INVALID

   

   

CreateFile
Reflector.zip.part

   

   

CloseFile
Reflector.zip.part

   

   

CreateFile
Reflector.zip.part

   

   

CloseFile
Reflector.zip.part

   

   

CreateFile
Reflector.zip.part

   

   

DeviceIOControl
Reflector.zip.part
INVALID PARAMETER

   

   

CloseFile
Reflector.zip.part

   

   

CreateFile
Reflector.zip.part
NAME INVALID

   

   

CreateFile
Reflector.zip.part
SHARING VIOLATION

   

   

QueryOpen
Reflector.zip
NAME NOT FOUND

   

With Chrome it seems my Anti-Virus is not even attempting to scan the .crdownload file.

However when using IE initially the AV fails to open the file, but keeps trying:


The important thing though is the CreateFile parameters used:


Share Mode is read-write, this should be OK, other process such as IE should still be able to write to file.

But then later down the line another CreateFile event is different


In this case the file is opened by the Anti-Virus with Share Mode Read, this means other process cannot write to the file.


Now we look at how Microsoft Security Essentials opens the file, on which machines with this installed I have not been able to replicate this issue. Security essentials performs CreateFileMapping on the .partial file but gets result FILE LOCKED WITH WRITERS twice, followed by FILE LOCKED WITH ONLY READERS on the actual .zip file. We don’t see any CreateFile events on the .partial file at all. (Much like with CA eTrust I do not see such events for Google Chrome’s .crdownload file)


After this CreateFileMapping we see the CreateFile events on the final .zip file.


However when going into the properties there is an important difference. All CreateFile events on the file from MS Security essentials were limited to access of Read Attributes, Synchronize and Share Mode allows Read, Write, and Delete.


I couldn’t find any configuration options in IE9 regarding the download manager or ways to disable it. The reference to .partial is hard-coded into C:\windows\system32\ieframe.dll or C:\windows\syswow64\ieframe.dll (for 32-bit IE on 64-bit OS)

Using F12 to bring up Developer Toolbar in IE we can see the actual download of data from network completed without error:


Finally this does not occur on all downloads, not even all downloads of same file type.

Failed downloads include:

Downloads that worked:

In general it seems to only happen for me with files that are larger than a certain size (~2 MB+). Mostly .zip files, but in some cases .exe files as well (such .exe files so far have been self-extracting executables). If anybody is finding a pattern on what files fail for them?

Excluding .partial from real-time scanning will fix the issue. I am raising support case with the relevant AV vendor, as using another AV product this issue does not occur. I am also providing information about this problem directly to Microsoft, so let me know any details about your system/scenarios of this download. If IE9 implements this process of renaming file differently I believe it should also be able to resolve the issue. Immediately after the failure occurs I am able to manually rename the .partial file to the correct filename.

Thanks to readers with their comments. It seems problem is known to occur with

  • AVG
  • McAfee Enterprise 8.8
  • CA eTrust (ITM)

I can’t replicate the issue with

Let us know your configuration if you see this issue, and provide some examples of files attempting to download that are failing.

About Malcolm McCaffery

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Application Compatibility, Internet Explorer, Troubleshooting, Windows 7 and tagged . Bookmark the permalink.

24 Responses to Case of the IE9 .Partial Download Fail

  1. Great case, Malcom! Do you have a log file you can send me?

  2. Damien says:

    I’m quite interested in seeing the results of the research into this. I get this issue quite a bit on my system as well [Win 7 Ult x64 Ballmer Edition]. I’m using a different brand of AV software, but I had the feeling it was keeping something tied up when IE was getting ready to do the rename to the correct file. Excluding the extension is a little trickier in my case, as the software still limits to *three* characters for file extensions… Why it still has that limit is beyond me.

    I haven’t seen the problem happen with Firefox in my instance, unless the AV hits a false positive, but in that case an AV warning dialog gets thrown.

    Thanks so much for posting this article,

    Damien

    “The key to immortality is first living a life worth remembering.”
    - Bruce Lee

  3. Damien says:

    Using McAfee VirusScan Enterprise 8.8 for the AV software on my laptop. I’ve seen the downloads hang at the 99% mark with 1 second & even at 100% with 0 seconds. Just like you mentioned above, I can rename the .partial file to the correct extension & it works perfectly.

    The other thing I noticed is that IE will leave processes running in the background after a download “hangs” at the end, even if I’ve quit the program through File\Exit, right click on the title bar\exit, or even ALT+F4. Each process left running winds up corresponding to a “hung” download.

    There’s an area where that issue of the processes not going away can be problematic. If you’re using InPrivate mode when this happens & close the browser window, the next “new” InPrivate session will be able to see the hung downloads in the download manager. Instead of clearing everything out, it essentially acts as if you never exited the InPrivate session at all, since the hung download processes that never quit are children of that original InPrivate browsing session. It will just re-attach to the already running InPrivate process from before.

    • OK I will see if I can get a chance to test with McAfee, I have some customer using this version of AV.

      With my current setup though I can’t reproduce the issue of internet explorer process not exiting. i am interested to find more details about this scenario.

      • Damien says:

        In my case, the downloads stop at the 99 or 100 percent phase, then just sit there without completing or failing. If I try to close IE with any of the downloads in this state, the processes stay running in the background. I’ve left them this way for hours too.

        This usually happens if I’m downloading several large files at once. Say some ZIP files with software updates, some EXE driver packages, & multimedia files (MP4 / WMV) from sites I subscribe to.

        Might just be specific to how my browsing & downloading behavior interacts with the cause of the hang.

  4. heather says:

    Wow, I have been having this problem since I updated to IE 9. I have been researching the problem on the Internet (and through Microsoft’s support pages) for two months now. I am so relieved to see this post! I was sure I was the only user this was happening too! [sigh of relief]

    I am a pretty advanced home user, and I am going to try and fix this by renaming my file extension, since my downloads are hanging at the 99% point, and I am running AVG as my anti-virus tool. At least if that doesn’t work, I will be able to print this out to take to my “computer guy” to show him the problem so he won’t think I am crazy!

    Also, I did scan for viruses, and reset IE 9 to its default settings and that didn’t help one bit. I just cannot tell you the relief I am feeling about seeing this post. It has made my whole day, what a Mother’s Day gift!

    Also, going to download Google Chrome as soon as I fix this problem. I’m not married to IE 9 and this problem has forced me to do a lot of shuffling around these last two months. Not sure if Bill Gates will feel the impact, but I will feel a little bit better…

    Thank you so much!!

  5. Margot says:

    i use microsoft security essentials and DO have the problem you’ve addresses above (partial downloads).

    Please let me know if you find a solution. Please email.
    I’m not a techie so don’t know what information you need, or where to find it. Happy to help, if you can tell me what you need and hw to find it.

    • Can you please tell me the following

      1) Can you open a command prompt on your computer (Type cmd.exe [enter] in Start Menu search bar)
      2) At the command prompt type the following command followed by [enter]

      wmic product get Description,Vendor,Version > out.txt

      3) Then open the file out.txt (you can just type it in the command line and hit [enter]) Please paste the contents here

      4) Can you give me some examples of downloads that fails? i.e. every download/or only certain types of downloads? what error message at failure?

      • by the way, the WMIC can take a few minutes to run without seeming to do anything, that is normal.

      • Margot says:

        .pdfs seem to download-save-as OK; but .docx save as adds the “partial” wording; for example filename.docx.44ytaan.partial

        If I merely delete everything after .docx it works fine, but that’s clearly not a permanent solution.

        Here’s the info you requested:

        Description Vendor Version
        Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Excel MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office PowerPoint MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Publisher MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Outlook MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Office 64-bit Components 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Word MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Proofing (English) 2007 Microsoft Corporation 12.0.4518.1014
        Microsoft Office Shared MUI (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Proof (English) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Proof (Spanish) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Proof (French) 2007 Microsoft Corporation 12.0.6425.1000
        Microsoft Office Small Business 2007 Microsoft Corporation 12.0.6425.1000
        CCC Help Italian ATI 2010.0122.0857.16002
        ccc-utility64 ATI 2010.0122.858.16002
        Skype Toolbars Skype Technologies S.A. 1.0.4051
        Catalyst Control Center Graphics Full Existing ATI 2010.0122.858.16002
        CCC Help Japanese ATI 2010.0122.0857.16002
        Quicken 2011 Intuit 20.1.1.24
        Safari Apple Inc. 5.33.21.1
        iTunes Apple Inc. 10.2.2.12
        MobileMe Control Panel Apple Inc. 3.1.6.0
        C6100 Hewlett-Packard 130.0.365.000
        c6100_Help Hewlett-Packard 82.0.256.000
        Garmin City Navigator Europe NT 2011.10 Garmin Ltd or its subsidiaries 14.10.0.0
        Apple Application Support Apple Inc. 1.5.1
        Scan Hewlett-Packard 13.0.0.0
        EasyTether Mobile Stream 1.1.11
        Catalyst Control Center – Branding ATI 1.00.0000
        CCC Help Portuguese ATI 2010.0122.0857.16002
        Bonjour Apple Inc. 2.0.5.0
        CCC Help Chinese Traditional ATI 2010.0122.0857.16002
        WIDCOMM Bluetooth Software 6.2.0.9603
        BufferChm Hewlett-Packard 130.0.331.000
        Catalyst Control Center Graphics Light ATI 2010.0122.858.16002
        Microsoft Antimalware Microsoft Corporation 3.0.8107.0
        Java(TM) 6 Update 24 Sun Microsystems, Inc. 6.0.200
        Java(TM) 6 Update 20 (64-bit) Sun Microsystems, Inc. 6.0.200
        CCC Help Danish ATI 2010.0122.0857.16002
        Apple Mobile Device Support Apple Inc. 3.4.0.25
        CCC Help French ATI 2010.0122.0857.16002
        HPProductAssistant Hewlett-Packard 130.0.371.000
        ccc-core-static ATI 2010.0122.858.16002
        WebReg Hewlett-Packard 130.0.132.017
        DocProc Hewlett-Packard 13.0.0.0
        CCC Help Spanish ATI 2010.0122.0857.16002
        CCC Help Norwegian ATI 2010.0122.0857.16002
        Copy Hewlett-Packard 130.0.428.000
        MSXML 4.0 SP2 (KB973688) Microsoft Corporation 4.20.9876.0
        SolutionCenter Hewlett-Packard 130.0.373.000
        CCC Help Swedish ATI 2010.0122.0857.16002
        CCC Help German ATI 2010.0122.0857.16002
        Network64 Hewlett-Packard 130.0.572.000
        DeviceDiscovery Hewlett-Packard 130.0.465.000
        CCC Help Russian ATI 2010.0122.0857.16002
        HP Update Hewlett-Packard 4.000.011.006
        UnloadSupport Hewlett-Packard 11.0.0
        64 Bit HP CIO Components Installer Hewlett-Packard 6.2.1
        AIO_CDA_ProductContext Hewlett-Packard 130.0.365.000
        Skins ATI 2010.0122.858.16002
        Catalyst Control Center Graphics Previews Vista ATI 2010.0122.858.16002
        Garmin USB Drivers Garmin Ltd or its subsidiaries 2.3.0.0
        Google Update Helper Google Inc. 1.3.21.53
        QuickTime Apple Inc. 7.69.80.9
        Catalyst Control Center Graphics Previews Common ATI 2010.0122.858.16002
        Status Hewlett-Packard 130.0.469.000
        Apple Software Update Apple Inc. 2.1.2.120
        CCC Help Chinese Standard ATI 2010.0122.0857.16002
        GPBaseService2 Hewlett-Packard 130.0.371.000
        Toolbox Hewlett-Packard 130.0.648.000
        CCC Help Finnish ATI 2010.0122.0857.16002
        Foxit Toolbar Ask.com 1.8.0.0
        Fax Hewlett-Packard 130.0.418.000
        Destinations Hewlett-Packard 130.0.0.0
        Skype™ 4.2 Skype Technologies S.A. 4.2.169
        CCC Help Korean ATI 2010.0122.0857.16002
        CCC Help English ATI 2010.0122.0857.16002
        Google Gears Google 0.5.3600
        TrayApp Hewlett-Packard 130.0.422.000
        Catalyst Control Center Localization All ATI 2010.0122.858.16002
        Catalyst Control Center Graphics Full New ATI 2010.0122.858.16002
        Catalyst Control Center Core Implementation ATI 2010.0122.858.16002
        Microsoft Silverlight Microsoft Corporation 4.0.60310.0
        MSXML 4.0 SP2 (KB954430) Microsoft Corporation 4.20.9870.0
        Microsoft .NET Framework 4 Client Profile Microsoft Corporation 4.0.30319
        Google Earth Plug-in Google 5.2.1.1588
        AIO_Scan Hewlett-Packard 130.0.365.000
        Quickset64 Dell Inc. 9.6.8
        Microsoft Security Client Microsoft Corporation 2.0.0657.0
        HPPhotoGadget Hewlett-Packard 130.0.282.000
        Java Auto Updater Sun Microsystems, Inc. 2.0.3.1
        AIO_CDA_Software Hewlett-Packard 130.0.365.000
        CCC Help Dutch ATI 2010.0122.0857.16002

  6. Rom says:

    Hi Malcolm

    Thanks for all this reasearching, great article

    Had read the article b4 just a bit and then found the same problem with my IE 9 on Win7 downloading Performance Analysis of Logs (PAL) Tool
    http://pal.codeplex.com/releases/view/16807

    and opened procmon to track down “PAL_v1.3.4.3.zip” when my braind clicked and rememver your article .. so here I am with my details , you got the path and the filename, will send you my out.txt soon

    Cheers Rom

  7. Damien says:

    So, I just found a blog from the AsiaSupp TechNet site that had some interesting comments.

    Blog: http://bit.ly/iIjrzQ

    Summary, the steps they suggest for now are testing with “No add-ins” mode, disabling antivirus temporarily, & leaving the tab you started the download from open in IE. </strong.

    That last part was what interested me the most, since I'm usually downloading several things at the same time. Media, patches, game utilities, modding tools, etc… For most of these, I start the download, close out the tab since the download started, & go about my business.

    I'll be testing the leave the tab open comment later to see if works.

    • Damien says:

      Ok, I’m a dork, it’s tired, & I messed up the bold option in the post I’m replying to. Any way to fix that to just the end of the sentence & then delete this reply?

    • Thank you for this information. However it occurs even when running iexplore -extoff (no add ons) and also when leaving page open. While disabling anti-virus is an option, this is possible the worst advice/practice ever when downloading files from the internet. These suggestions have no effect for me, and as the logging I’ve done it points purely to the Anti-Virus, and the way IE9 renames the file.

  8. Roger Findley says:

    I’m in the same boat. I run Webroot Internet Security Essentials. I am thrilled to know I can rename the partial files. It happens to me usually when downloading several large files at once. I get the 99% with 1 second remaining message usually. Once I got 100% with 0 seconds remaining.

  9. Eivind Gussiås Løkseth says:

    I just got the problem with a WMV-file: Tried to download the high quality wmv file for this video: http://channel9.msdn.com/Shows/Web+Camps+TV/CodeMash-2011-PayPal-Whats-new-in-eCommerce-with-Rasesh-Shah

    I’m using Microsoft Security Essentials.
    The video downloaded perfectly with Chrome.

    I’ve seen this on lots of PC’s. Also with very small files, like shortcuts for citrix applications. Using FireFox 4 instead of IE9 solved the problem at that machine.

    I’ll check which antivirus software is installed on the machines where I get this failure from now on.

    And great to know that the downloaded file can just be renamed! I’ve always downloaded it over again using another browser.

  10. Having the same issue with Microsoft Security Essentials. It happens always with .torrent files but also with others (tried to download something arbitrary from Microsoft download site and it failed at first). Funny thing was that this always happened during the beta stage of IE9. When I installed the RTW version, it downloaded perfectly until like a week ago (I know vague, but that’s what it is).

  11. Pete says:

    I am also experiencing this, and am using Microsoft Security Essentials for antivirus. It seems to be intermittent, or at least I haven’t detected the pattern yet. I see it most often with MP4 files, especially if the download is proceeding very slowly.

    • Damien says:

      Yes, this is what I tend to see the most failures with as well [MP4 files], although I am using McAfee VirusScan Enterprise 8.8 on my system.

      @Pete: If you leave the tab open on the exact same page you started the download on, does it seem to finish successfully? Not just keep it open & continue browsing within the tab/IE, but literally leaving it on whatever page the download kicked off from. Doing that has let me finish downloading all the large multimedia files I used to have problems with.

      I haven’t been able to reliably reproduce the failure on smaller files on my system yet, so I think it might be a similar problem with the same root cause. I guess I could try to find a way to artificially limit my bandwidth & force smaller files to take a long time to finish downloading…

  12. Please anyone has the issue up the vote on the bug reported on Microsoft Connect. Currently the issue has been closed as “not reproducable” This requires a Windows Live ID.
    https://connect.microsoft.com/IE/feedback/details/669001/downloads-complete-on-network-but-do-not-get-renamed-from-partial-to-final-filename

    • Pedro Sousa says:

      Hi,
      First of all, let me congratulate you on your excellent post and debug of this issue. It’s not every day we see a post with a Mark Russinovich comment!!! Thumbs Up!!!
      We have the exact same problem with both IE9 and Firefox 6.0.2. Currently our antivirus is CA eTrust 8.1, at least until next March when our licensing ends… We are strongly considering a change but that’s another subject.
      I’ve tried to vote on the bug report on Microsoft Connect but got a “missing page” error!!!
      Any luck with CA Support? Have you opened a post on CA Support Forum?

      I will follow this post and hope we can find a solution this problem… (My user’s start complaining a lot about it!!!)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s