Are you running a virus scanner on the machine hosting the repositories? If
so, which one, and could you try to disable it and redo the test scenario?

I cannot immediately reproduce it with using hg serve (instead of setting up
an apache server).