It seems that right before the security file download dialog is displayed, IE calls IOleCommandTarget.Exec with CmdGroup=CGID_Explorer and an nCmdId=66. I cannot find *anyplace* where this command ID is documented. Well, it seems that if we return S_OK from that call, the dialog is displayed. However if we return either