What is COM Surrogate or dllhost.exe and why does it run on the computer?

If you access Task Manager, you will see one or more COM Surrogate processes running on Windows computers. These processes have the file name dllhost.exe and are part of the Windows operating system. You will see it in Windows 10, Windows 8, Windows 7 and earlier versions of Windows.

What is COM Surrogate (dllhost.exe)?

COM stands for Component Object Model, which is an interface that Microsoft introduced in 1993 that allows developers to create 'COM objects' in many different programming languages. Basically, these COM objects plug into other applications and expand them.

For example, the Windows file manager uses COM objects to create thumbnail images of images and other files when it opens a folder. The COM object handles images, videos and other files to create thumbnails. This allows File Explorer to be expanded with support for new video codecs.

However, this may lead to problems. If the COM object has a problem, it will remove its storage process. Sometimes COM objects create a problem thumbnail and drag the entire Windwos Explore process with it.

To fix this problem, Microsoft created the COM Surrogate process. The COM Surrogate process runs a COM object outside of the original process that requested it. If the COM object fails, it will only remove the COM Surrogate process and the initial storage process will not fail. For example, Windows Explorer (now called File Explorer) launches a COM Surrogate process whenever it needs to create thumbnail images. The COM Surrogate process stores the COM object that performs the job, if the COM object is down, only COM Surrogate is affected and the original File Explorer process will continue to work.

And COM Surrogate is named "dllhost.exe" because the COM objects it stores are .dll files.

How to know the COM object stored in a COM Surrogate?

The standard Windows Task Manager does not provide any information about the COM object or DLL file that COM Surrogate is storing. If you want to know about this information, you should use Microsoft's Process Explorer tool, download it and hover over the dllhost.exe process in Process Explorer to see the COM Object or the DLL file stored.

You can see the screenshot below, this is the dllhost.exe process that is hosting the CortanaMapiHelper.dll object.

Can disable COM Surrogate?

You cannot disable the COM Surrogate process because it is an essential part of Windows. It is actually a container process used to launch COM objects that other processes want to run. For example, Windows Explorer (or File Exlorer) regularly creates a COM Surrogate process to create thumbnails when opening folders. Other programs can also create their own COM Surrogate process. All dllhost.exe processes on the system are started by other programs to perform the task that the program wants.

Is the COM Surrogate process a virus?

The COM Surrogate process is not a virus, and is a normal part of Windows. However, the malware can use it. For example, Trojan.Poweliks malware uses the dllhost.exe process to do the job with its bad purpose. If you see a large number of dllhost.exe processes running and they use a significant amount of CPU, that means the COM Surrogate process is taking advantage of viruses or other malware.

If you are concerned that malware is using the dllhost.exe or COM Surrogate process, you should scan the system with antivirus software to find and remove it from the system. If the antivirus software you use does not find malware but you still suspect it can run with another program for reference.

See more:

1. What is the Windows.old folder and how do you delete it?
2. What is the Client Server Runtime Process or csrss.exe and why does it run on the computer?
3. Learn the Windows Modules Installer Worker process