# What Is COM Surrogate and Why Is It Running on Windows

COM Surrogate is a normal Windows process, `dllhost.exe` in `C:\Windows\System32`, that runs a component in a separate process so a failure there cannot take down the program that asked for it. The usual reason you see it is File Explorer generating thumbnails. Several copies are normal, and one that appears and disappears as you browse folders is doing its job. A copy that stays busy, or a file "open in COM Surrogate", normally points at one thumbnail handler or one bad file.

## Why it exists

Windows programs often load extra code as a COM component in a DLL. If that DLL crashes inside the program, the whole program goes with it. Raymond Chen explains on [Microsoft's Old New Thing](https://devblogs.microsoft.com/oldnewthing/20090212-00/?p=19173) that Explorer uses the COM Surrogate when extracting thumbnails, so a crash in a thumbnail extractor destroys the surrogate process rather than Explorer. That also explains the old "COM Surrogate has stopped working" message: it usually means a component crashed in there, and Explorer survived because of the design.

Windows starts it by asking for a specific component:

```text
C:\Windows\System32\dllhost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
```

That ID is the one to look up, and that one is Windows' thumbnail cache. Other programs use the same process for their own components, which is why the name alone says little about who is behind a busy copy.

## Find out which component it is

1. Press `Ctrl + Shift + Esc` and open the **Details** tab.
2. Right-click a column header, choose **Select columns**, and tick **Command line**.
3. Find `dllhost.exe` and read the ID after `/Processid:`.

Or list every copy from PowerShell:

```powershell
Get-CimInstance Win32_Process | Where-Object Name -eq 'dllhost.exe' | Select-Object ProcessId, CommandLine
```

Then look up the ID, replacing it with yours:

```powershell
(Get-ItemProperty 'Registry::HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}').'(default)'
```

On Windows 11 that one returns `Thumbnail Cache Class Factory for Out of Proc Server`. If yours names a third-party product, that product's update or removal is the fix.

## What to do about each symptom

| You see | Likely cause | Try |
| --- | --- | --- |
| High CPU or disk while one folder is open | Thumbnails being generated for many large files | Wait it out, or switch that folder's view to **Details** |
| High CPU in the same folder every time | One damaged media file, or a codec that fails on it | Move files out in batches to find it, then update or remove the codec pack |
| "The action can't be completed because the file is open in COM Surrogate" | A thumbnail handler still holds that file | Close the preview pane and the folder, wait a few seconds, try again |
| It keeps crashing or "has stopped working" | A broken third-party component | Read the ID as above, then update or remove that software |
| Wrong or stale thumbnails | A damaged thumbnail cache | Clear **Thumbnails** in Disk Cleanup, see [Disk Cleanup or Storage Sense](/windows/blog/disk-cleanup-vs-storage-sense-windows) |

To stop generating thumbnails altogether, open **File Explorer › See more (…) › Options › View** and tick **Always show icons, never thumbnails**. This takes the load off at the cost of pictures in folders. It is also a good test: if the problem stops, thumbnails were the cause.

## Is it a virus

The real one is a Microsoft-signed file in `C:\Windows\System32`, with a 32-bit copy in `C:\Windows\SysWOW64`. Malware can borrow the name, and it can also run its own code inside a genuine `dllhost.exe`, so a correct path is good evidence but not proof. Check the file first:

```powershell
Get-AuthenticodeSignature C:\Windows\System32\dllhost.exe
```

The signer should read `Microsoft Windows`. Be suspicious of a `dllhost.exe` running from anywhere else, a copy with heavy network activity, or a component ID that points to a file in `AppData` or `Temp`. If any of those fit, run a full scan with Microsoft Defender.

## What not to do

- Do not delete `dllhost.exe` or block it. Windows and many programs depend on it, and System File Checker will treat a missing copy as damage.
- Do not expect ending it to be a fix. It is safe to end a stuck copy, since a thumbnail or dialog may fail and Windows starts a new one when needed, but the cause is still there.
- Do not add it to Data Execution Prevention exceptions, as older guides suggest. That lowers a protection without finding the broken component.
- Do not install a registry cleaner or a "DLL fixer" for this. Neither identifies which component is failing.

## Where Mole fits

Mole for Windows' Status page folds COM Surrogate into one row per session, with CPU and memory summed across its copies. **Why is this running?** in the row's menu lists the heaviest copies with their PID, CPU and memory, and shows the **Executable**, what started it and, for a copy running unelevated under your own account, the **Command** with its `/Processid`, which saves the Task Manager columns. Click a copy to see its own details. Because COM Surrogate runs from the Windows folder, Mole marks it as System and offers no **Terminate** or **Force Quit**, so use Task Manager if you need to end a stuck copy. Mole does not repair thumbnail handlers, and its Clean page has no row for the thumbnail cache, so use Disk Cleanup for that. For wider background, see [what common Windows processes do](/windows/blog/windows-processes-explained).

## FAQ

### What is COM Surrogate?

It is `dllhost.exe`, a Windows process that hosts a component outside the program using it. A crash there stays there. File Explorer uses it for thumbnails, and other programs use it too.

### Why are there so many COM Surrogate processes?

Each copy hosts one component, so several at once is normal. Many of them exit by themselves once they have been idle.

### Can I end COM Surrogate?

Yes, ending a stuck copy is safe, and Windows starts a new one when it is needed. If the same copy keeps coming back busy, find its component ID rather than ending it repeatedly.

### Why does it say a file is open in COM Surrogate?

A thumbnail handler is reading that file. Close the folder and any preview pane, wait a few seconds and try again. If it keeps happening with the same type of file, turn on **Always show icons, never thumbnails** to confirm the cause.

### Is COM Surrogate a virus?

The genuine file is not. Check that it runs from `C:\Windows\System32` or `C:\Windows\SysWOW64` and is signed by Microsoft Windows, then look at which component it hosts.


Canonical: https://mole.fit/windows/blog/com-surrogate-dllhost