Since several weeks I noticed that when downloading files from the internet, after clicking a file to download – it took up to a minute before the “Open/Save/Cancel” golden bar appeared.
Very frustrating if you quickly want to download something.

The first troubleshooting step was to launch Internet Explorer 9 without any add-ons using “iexplore –extoff”. Internet Explorer reported it was running without add-ons:

After testing, the problem still occurred, it took exactly 54 seconds between the moment you clicked a file to download and the moment the dialog would appear:

Now it was time to start Procmon, I downloaded the latest version from http://live.sysinternals.com and started a new process monitor session and limited the process to “iexplore.exe”

Shortly after capturing the events I initiated a download in Internet Explorer 9, just after the download dialog to appear I stopped capturing events.

I could see some delays in the trace but at first it wasn’t obvious what was causing them. After browsing through the events I noticed several references to UNC locations:

As you can see in the picture above, Internet Explorer was trying to reach my Mediacenter PC.
My mediacenter wasn’t powered on and therefore a “BAD NETWORK PATH” was logged. However – my main question was “Why is Internet Explorer looking for these locations at all?”

The default download folder for IE9 is a folder on my local drive, therefore I was wondering why IE9 was looking in places I – probably – previously downloaded files to.

A quick search through the Windows Registry didn’t reveal this information to be stored anywhere. That’s when I had a look in the “Download History” in IE9, you can access this by hitting CTRL-J. In my case it took another 54 seconds before the download history dialog to appear. This is where I could see the references to my Mediacenter PC.

After clearing the list I tested the download functionality and this time it the golden bar would appear immediately.
Thanks to Procmon we now know that IE9 tries to reach to previous download locations, including UNC locations to unreachable machines.

Another case closed thanks to Procmon.