COM Surrogate in Windows 10: Should You Worry? In this article, I’ll explain what it is and whether or not you should be concerned.
Has the COM Surrogate process in Windows 10’s task manager ever piqued your interest? Two of them were running when I looked through the list of processes.
It cannot be easy to decipher Task Manager’s various processes. For example, Svchost.exe, the process that houses various Windows services, has already been the subject of a lengthy post from me. At any given time, you may have between 10 and 15 of these processes running.
[lwptoc]
What is COM Surrogate in Task Manager?
Well, COM Surrogate is one of those processes that, upon first glance, does not reveal anything about its operation. Without a custom icon or any additional information about what it does, it just sits there.
Multiple COM Surrogate processes can be active at the same time. Two of them are usually active if you look in task manager.
The process name is dllhost.exe, which you can see by right-clicking on either one and selecting Go to Details. The process also runs under your username, not the System, Local Service, or Network Service accounts, as you may have noticed before this.
Fortunately, COM Surrogate does not contain any viruses (most of the time). Running in the background, it’s a real Windows 10 process. The process is known as dllhost because it hosts DLL files. That probably doesn’t make any sense, so allow me to elaborate.
COM Objects are software extensions created by Microsoft for software developers. Specific Windows 10 programs also make use of this. For example, the Windows Explorer COM object can create thumbnails for images and videos in a folder.
Crashing COM objects and the Explorer process were both common problems with these objects. Because of this, if a COM object failed for any reason, your entire system would go down with it.
Microsoft created the COM Surrogate process to address this problem. This process executed the COM object in a separate process from the one that requested it. To use the Explorer example, instead of running as a COM object in the explorer.exe process, this newly created COM surrogate process would be used to run as a COM object instead.
COM objects no longer take out the entire Explorer process when they fail, but only the COM Surrogate process remains. Isn’t that clever? You can see the COM object I’m referring to in Process Explorer, which is free to download.
The extension used to create thumbnails in Explorer is Microsoft Thumbnail Cache, which can be seen if you hover your mouse over the dllhost.exe entry.
Is COM Surrogate a Virus?
How to know if COM Surrogate is virus: Trojans and viruses have used COM Surrogate and other Windows processes in the past to hide in the Windows operating system. You can find the process’s origin by opening Task Manager, right-clicking on the process, and selecting Open file location.
Windows COM Surrogate processes that result in the C:WindowsSystem32 folder containing a file named ‘dllhost’ are unlikely to be malicious. If you follow the link, you’ll want to run a virus scan right away.
Only one or two instances of COM surrogates are usually running at any given time. Do an offline virus scan to detect tricky hidden viruses better if you see a lot of dllhosts.exe processes or if the process consumes more than 1 to 2 percent of your CPU.
After reading this post, you should better understand COM Surrogate and how it works in Windows 10. Then, if you see processes like this in the future, you don’t need to be alarmed.
ALSO SEE:
Dear Readers, if you still have concerns about how to fix COM Surrogate high CPU usage in Windows 10, feel free to ask in the comments section below, and I’ll definitely do my best to help you.
