What is “COM Surrogate” (dllhost.exe)?

You might have opened your Task Manager, and found that a process called “COM Surrogate” is running on your Windows PC. All these processes are in the form of a file or process named “dllhost.exe”. And this file is a part of Windows OS. You will see these files in most of your Windows versions such as com surrogate Windows 10, Windows 8, Windows 7 and other previous versions.

Do check these Related articles:

Host Process for Windows Tasks – Everything you need to know about it

What is Windows Shell Experience Host?(All things you need to know about it)

So, in this post, we will clear all your queries regarding “COM Surrogate” so that in future you would not be surprised to see this process in your Task Manager.

So, What exactly is “COM Surrogate” (dlhost.exe)?

COM or Component Object Model is an interface which was developed by Microsoft in 1993 which allows developers to create COM Objects using multiple programming languages. Basically, these COM objects extend the functionality of an application by extending them.

For example, When you open your File Manager and you see thumbnails of folders and files. Now, this functionality is obtained by using a COM object that handles these images, videos, and all other files. They help in generating thumbnails. This functionality allows viewing your files in a much better way in File Explorer rather than just seeing the filename of a file.

What Happens when COM object crashed?

If a COM object gets crashed then the Host Process which was using it will be killed. It was a common scenario in early versions of Windows where COM objects responsible for generating thumbnails would crash down. And this would take down Windows Explorer.

Solution to COM object crashed problem

Microsoft came with a solution for this kind of problem that it will create COM Surrogate Process. The COM Surrogate Process would run a COM object outside the original process that requested it. Now, if COM object crashes then COM Surrogate Process will be killed and not the Original Host process won’t get crashed.

For Example, if thumbnail generating COM object crashed then your File Explorer won’t be stopped instead the COM Surrogate process will be crashed. COM Surrogate process will save Original Process using COM Object from crashing.

In Microsoft blog The Old New Thing put it this way,”the COM Surrogate is the I don’t feel good about this code, so I’m going to ask COM to host it in another process. That way, if it crashes, it’s the COM Surrogate sacrificial process that crashes instead of me process.”

Why is COM Surrogate named as “dllhost.exe”?

Its because COM objects are all .dll files and it acts as a host for these .dll files.

How to know Which COM Object a COM Surrogate is Hosting?

You cannot get information about which COM Object a COM Surrogate is Hosting using default Windows Task Manager. For seeing this information, you can download Microsoft’s Process Explorer tool. After installing it, you can just mouse-over a “dllhost.exe” process in Process Explorer and then you will see which COM Object or DLL file it is hosting. You can also view com surrogate disk usage using Process Explorer.

Can I Disable “COM Surrogate” process?

No, you cannot disable it as it’s one of the System processes of Windows. Also if it was allowed to disable it, then the system would have had Programs getting crashed frequently if the associated COM Object files get interrupted or crashed. It’s just a container which will hold the COM Object associated with a process. COM Surrogate is really a surrogate process which will come to play if the COM Objects associated with a program gets crashed. And then this surrogate process will actually be killed instead of the original COM Objects process. Therefore, all dllhost.exe processes are started by programs that are opened by the user.

Can “COM Surrogate” process be a Virus?

No, it cannot be a virus as its a System process which saves Programs from being crashed if their associated COM Objects process gets crashed. But, some malware can use it to create Problems for the user. For example, Trojan.Poweliks malware uses “dllhost.exe” to create problems in the System. You can observe this if your see very large number of “dllhost.exe” processes running in your Task Manager. This leads to com surrogate high cpu problem thus making your System Hang or slow. This indicates a malware has affected your system and has affected the COM Surrogate Process to create these problems. Its best to scan with a Good Antivirus Program to know which malware is this and remove it quickly from your System.