3

I'm running Windows 7 Professional 32-bit. When downloading a ZIP file in Firefox, a DllHost.exe process appears. The command line is this:

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

It is always the same ProcessID, and the process is related to wininet.dll (C:\Windows\System32\wininet.dll). The Name of the AppID key in the registry is "WinInetCacheServer".

This doesn't seem to happen when downloading .exe files, though.

What is this WinInetCacheServer and what is it doing on my system? It definitely was not there before, I think this whole thing appeared after installing Internet Explorer 10 via Windows Update.

I know that wininet.dll seems to be legit Microsoft stuff, but when a new process that has not been around before suddenly appears, my alarm flags go up. Any recommendations?

|improve this question
  • I have tested this on another system, where the Internet Explorer 10 update delivered via Windows Update is not yet installed. As expected, the process desribed above does not appear. – Awa Apr 15 '13 at 16:37
  • Small follow up: Same process (same AppID, etc.) appears when IE 10 is started. The process is not running after a system boot. When closing IE, the process keeps running. And uses a small amount of CPU time. (Line breaks seem to be broken, why?) – Awa Apr 16 '13 at 23:02
2

Dev Center on msdn.microsoft.com confirms that this is intended:

The WinINet functions have simple, yet flexible, built-in caching support. Any data retrieved from the network is cached on the hard disk and retrieved for subsequent requests. The application can control the caching on each request.

It also mentions, that there are certain rules, for example

  • "The cache-control directives and application set flags determine what may be cached (...)"
  • "In general, responses to the GET verb are cached if the requirements listed above are met. Responses to PUT and POST verbs are not cached under any circumstances."
  • "Https is cached by default."

So yes, this is a legit process from windows, but if you want to identify the behaviour and how it is controlled, -> why a .zip is cached and an .exe is not, you will have to dig a little deeper into this topic.

|improve this answer
  • OK, thanks for the link.. Not sure though why Firefox would use this WinInet API. – Awa Apr 16 '13 at 12:08
  • The autostart location according to Process Explorer is HKLM\System\CurrentControlSet\Services\COMSysApp. So it should be possible to configure this via the Component Services (comexp.msc), correct? How do I disable and/or remove this WinInet object? – Awa Apr 16 '13 at 12:22
  • Does WMIC work? WMIC can list all DCOM objects, and offers a DCOMAPP DELETE command. Have not tried it yet. Does this break anything, like IE? Has someone experience with this? – Awa Apr 16 '13 at 23:06
  • DCOMPAPP DELETE was not able to remove the entry: Deleting instance \\PC\ROOT\CIMV2:Win32_DCOMApplication.AppID="{3eb3c877-1f16-487c-9050-104dbcd66683}" ERROR: Description = Provider is not capable of the attempted operation – ssnobody Jun 9 '17 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.