What Is COM Surrogate? Is It Safe to Disable at Startup?

What Is COM Surrogate?

COM Surrogate is the common name for dllhost.exe, a built-in Windows process from Microsoft. Windows uses it to run COM objects outside the main app process. In plain English, it is a safety wrapper: if a thumbnail handler, codec, shell extension or similar component crashes, it can fail inside COM Surrogate instead of taking File Explorer or another app down with it.

You may see one or more dllhost.exe processes in Task Manager. That is normal. Different apps and Windows components can start their own COM Surrogate instances when needed.

Is It Safe?

Usually, yes. The real COM Surrogate is a legitimate Windows system process and must stay available.

Because malware sometimes copies the name of trusted Windows files, check the file location if dllhost.exe looks suspicious. The genuine file should normally be in C:\Windows\System32 on 64-bit Windows, and there may also be a 32-bit copy in C:\Windows\SysWOW64. In Task Manager, right-click the process and open its file location. If it runs from a user profile, Downloads, Temp, or another unusual folder, investigate it.

You can also check the file's digital signature in Properties. A real Windows copy should be signed by Microsoft.

Should I Disable It at Startup?

No. COM Surrogate is not a normal startup app that you turn on or off. It is a system process that Windows launches when needed.

If you see dllhost.exe linked to a startup-related issue, the cause is usually not COM Surrogate itself. More often, a third-party shell extension, media codec, preview handler or other COM component is being loaded through it. In that case, investigate the related app or extension rather than trying to disable COM Surrogate.

Why Is It Using High CPU or Memory?

Short spikes are common when Windows generates thumbnails, previews photos or videos, or loads shell extensions. Constant high CPU, repeated crashes, or heavy memory use is not normal.

Common causes include a broken thumbnail handler, faulty codec pack, buggy context-menu extension, damaged media files, or malware using the same name. If the problem starts when browsing a folder of videos or images, the trigger may be thumbnail generation. If it happens all the time, look for recently installed Explorer add-ons, media tools, or suspicious files.

You can end a stuck dllhost.exe process, but Windows or the app may start it again. Do not delete the file.

How to Disable or Remove It

Do not remove dllhost.exe. It is part of Windows.

If you need to stop the symptoms, focus on the component behind it:

• Check the file location and signature of dllhost.exe.
• Scan for malware if the file path is unusual or behavior looks suspicious.
• Update or uninstall recently added codec packs, shell extensions, or file preview tools.
• If the issue appears in File Explorer, test whether it happens only in folders with media thumbnails.
• Use Windows maintenance tools if system files seem damaged.

Where Kudu Helps

Kudu will not suggest disabling COM Surrogate as a startup item, because it is not one. If dllhost.exe is using too much CPU or memory, Kudu's Performance Monitor can show the PID, live resource use and any linked startup items around the same time.

If the process looks suspicious, Kudu's Malware Scanner can check for persistence and suspicious patterns, and quarantine supported detections. If a third-party app is behind the issue, Startup Manager can help you disable related startup entries while you test.

Download Kudu Free →