What Is COM Surrogate and Why Is It Running on Windows

COM Surrogate is a normal Windows process, dllhost.exe in C:\Windows\System32, that runs a component in a separate process so a failure there cannot take down the program that asked for it. The usual reason you see it is File Explorer generating thumbnails. Several copies are normal, and one that appears and disappears as you browse folders is doing its job. A copy that stays busy, or a file "open in COM Surrogate", normally points at one thumbnail handler or one bad file.

Why it exists

Windows programs often load extra code as a COM component in a DLL. If that DLL crashes inside the program, the whole program goes with it. Raymond Chen explains on Microsoft's Old New Thing that Explorer uses the COM Surrogate when extracting thumbnails, so a crash in a thumbnail extractor destroys the surrogate process rather than Explorer. That also explains the old "COM Surrogate has stopped working" message: it usually means a component crashed in there, and Explorer survived because of the design.

Windows starts it by asking for a specific component:

C:\Windows\System32\dllhost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

That ID is the one to look up, and that one is Windows' thumbnail cache. Other programs use the same process for their own components, which is why the name alone says little about who is behind a busy copy.

Find out which component it is

1. Press Ctrl + Shift + Esc and open the Details tab.
2. Right-click a column header, choose Select columns, and tick Command line.
3. Find dllhost.exe and read the ID after /Processid:.

Or list every copy from PowerShell:

Get-CimInstance Win32_Process | Where-Object Name -eq 'dllhost.exe' | Select-Object ProcessId, CommandLine

Then look up the ID, replacing it with yours:

(Get-ItemProperty 'Registry::HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}').'(default)'

On Windows 11 that one returns Thumbnail Cache Class Factory for Out of Proc Server. If yours names a third-party product, that product's update or removal is the fix.

What to do about each symptom

To stop generating thumbnails altogether, open File Explorer › See more (…) › Options › View and tick Always show icons, never thumbnails. This takes the load off at the cost of pictures in folders. It is also a good test: if the problem stops, thumbnails were the cause.

Is it a virus

The real one is a Microsoft-signed file in C:\Windows\System32, with a 32-bit copy in C:\Windows\SysWOW64. Malware can borrow the name, and it can also run its own code inside a genuine dllhost.exe, so a correct path is good evidence but not proof. Check the file first:

Get-AuthenticodeSignature C:\Windows\System32\dllhost.exe

The signer should read Microsoft Windows. Be suspicious of a dllhost.exe running from anywhere else, a copy with heavy network activity, or a component ID that points to a file in AppData or Temp. If any of those fit, run a full scan with Microsoft Defender.

What not to do

• Do not delete dllhost.exe or block it. Windows and many programs depend on it, and System File Checker will treat a missing copy as damage.
• Do not expect ending it to be a fix. It is safe to end a stuck copy, since a thumbnail or dialog may fail and Windows starts a new one when needed, but the cause is still there.
• Do not add it to Data Execution Prevention exceptions, as older guides suggest. That lowers a protection without finding the broken component.
• Do not install a registry cleaner or a "DLL fixer" for this. Neither identifies which component is failing.

Where Mole fits

Mole for Windows' Status page folds COM Surrogate into one row per session, with CPU and memory summed across its copies. Why is this running? in the row's menu lists the heaviest copies with their PID, CPU and memory, and shows the Executable, what started it and, for a copy running unelevated under your own account, the Command with its /Processid, which saves the Task Manager columns. Click a copy to see its own details. Because COM Surrogate runs from the Windows folder, Mole marks it as System and offers no Terminate or Force Quit, so use Task Manager if you need to end a stuck copy. Mole does not repair thumbnail handlers, and its Clean page has no row for the thumbnail cache, so use Disk Cleanup for that. For wider background, see what common Windows processes do.

FAQ

What is COM Surrogate?

It is dllhost.exe, a Windows process that hosts a component outside the program using it. A crash there stays there. File Explorer uses it for thumbnails, and other programs use it too.

Why are there so many COM Surrogate processes?

Each copy hosts one component, so several at once is normal. Many of them exit by themselves once they have been idle.

Can I end COM Surrogate?

Yes, ending a stuck copy is safe, and Windows starts a new one when it is needed. If the same copy keeps coming back busy, find its component ID rather than ending it repeatedly.

Why does it say a file is open in COM Surrogate?

A thumbnail handler is reading that file. Close the folder and any preview pane, wait a few seconds and try again. If it keeps happening with the same type of file, turn on Always show icons, never thumbnails to confirm the cause.

Is COM Surrogate a virus?

The genuine file is not. Check that it runs from C:\Windows\System32 or C:\Windows\SysWOW64 and is signed by Microsoft Windows, then look at which component it hosts.