I'm running Windows 7 Professional 32-bit. When downloading a ZIP file in Firefox, a DllHost.exe process appears. The command line is this:

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

It is always the same ProcessID, and the process is related to wininet.dll (C:\Windows\System32\wininet.dll). The Name of the AppID key in the registry is "WinInetCacheServer".

This doesn't seem to happen when downloading .exe files, though.

What is this WinInetCacheServer and what is it doing on my system? It definitely was not there before, I think this whole thing appeared after installing Internet Explorer 10 via Windows Update.

I know that wininet.dll seems to be legit Microsoft stuff, but when a new process that has not been around before suddenly appears, my alarm flags go up. Any recommendations?

  • I have tested this on another system, where the Internet Explorer 10 update delivered via Windows Update is not yet installed. As expected, the process desribed above does not appear.
    – Awal
    Commented Apr 15, 2013 at 16:37
  • Small follow up: Same process (same AppID, etc.) appears when IE 10 is started. The process is not running after a system boot. When closing IE, the process keeps running. And uses a small amount of CPU time. (Line breaks seem to be broken, why?)
    – Awal
    Commented Apr 16, 2013 at 23:02

1 Answer 1


Dev Center on msdn.microsoft.com confirms that this is intended:

The WinINet functions have simple, yet flexible, built-in caching support. Any data retrieved from the network is cached on the hard disk and retrieved for subsequent requests. The application can control the caching on each request.

It also mentions, that there are certain rules, for example

  • "The cache-control directives and application set flags determine what may be cached (...)"
  • "In general, responses to the GET verb are cached if the requirements listed above are met. Responses to PUT and POST verbs are not cached under any circumstances."
  • "Https is cached by default."

So yes, this is a legit process from windows, but if you want to identify the behaviour and how it is controlled, -> why a .zip is cached and an .exe is not, you will have to dig a little deeper into this topic.

  • OK, thanks for the link.. Not sure though why Firefox would use this WinInet API.
    – Awal
    Commented Apr 16, 2013 at 12:08
  • The autostart location according to Process Explorer is HKLM\System\CurrentControlSet\Services\COMSysApp. So it should be possible to configure this via the Component Services (comexp.msc), correct? How do I disable and/or remove this WinInet object?
    – Awal
    Commented Apr 16, 2013 at 12:22
  • 1
    Does WMIC work? WMIC can list all DCOM objects, and offers a DCOMAPP DELETE command. Have not tried it yet. Does this break anything, like IE? Has someone experience with this?
    – Awal
    Commented Apr 16, 2013 at 23:06
  • DCOMPAPP DELETE was not able to remove the entry: Deleting instance \\PC\ROOT\CIMV2:Win32_DCOMApplication.AppID="{3eb3c877-1f16-487c-9050-104dbcd66683}" ERROR: Description = Provider is not capable of the attempted operation Commented Jun 9, 2017 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .