COM dll's cannot be loaded directly. They have to be called loaded by an
executable program. the COM surrogate, dllhost.exe, allows COM objects to
be built in a dll and then exposed by dllhost.exe. There are serious risks
in doing this and Microsoft should abandon the practice immediately. I
really had hoped they would, given their stated interests in improving
security with Windows Vista. When you allow access through your firewall to
dllhost.exe, you open your firewall to every single dllhost.exe instance in
your PC:
http://blogs.msdn.com/robgruen/archive/2004/08/18/216685.aspx
Dllhost, rundll32, and svchost are three system applications that, while
having legitimate system uses, can all be used to hide the process that is
really running on your PC. They each host DLLs, allowing the DLLs to be run
as applications. But when you use TaskManager to view running applications,
the actual DLL's running are not listed, only the hosts are listed. Each of
them fail to display the real name or file location of the processes that
they hide. And the risks outlined in the link above apply equally to
runndll32, svchost, and dllhost, though the article only refers to dllhost.
While there are tools by which you can determine what applications these
three hosts are hiding from you, those tools are generally considered
advanced tools. That means that, for most users, all three of those hosts
are effective means of hiding programs.
Like I said, I wish Microsoft would drop all three of these tools
immediately. There is no reason for an application to be built in a DLL
rather than in a real executable.
Dale