COM surrogate – How to fix it

What is COM surrogate

COM surrogate or dllhost.exe are processes part of the Windows operating system. If you open your Task Manager, you will likely see multiple COM surrogate processes running. This is completely normal. COM actually stands for Component Object Model, and COM object are plugged into other applications in order to extend them. It’s often used to create thumbnail images of images and files when a folder is opened. The COM surrogate processes run COM objects outside the original processes that request them, meaning if a COM object crashes, the original COM process won’t crash.

While you are likely seeing safe COM surrogate processes in your Task Manager, we should mention that it’s not impossible for malicious processes to be concealed as legitimate ones. Disguising malware as legitimate processes is a clever way to avoid detection by users. Anti-virus programs do detect such malware, but if a computer is not protected by a security program, users are unlikely to notice a malicious processes.

How to differentiate between the real and malicious dllhost.exe

The easiest way to avoid malware disguised as legitimate processes is to have reliable anti-virus software installed. The program would detect all known malware and prevent them from entering. However, you can also check whether a process is legitimate yourself. Open Task Manager, right-click on COM surrogate process and select Properties. The legitimate COM surrogate process will be located at C:\Windows\System32, and will have Microsoft Windows as the name of the digital signer. If COM surrogate is located somewhere else, you may be dealing with a malicious process imitating a legitimate one. If that is the case, we would strongly suggest scanning your computer with anti-malware software to determine whether malware is actually present. If there is something, the anti-malware would delete the malicious COM surrogate process.