COM Surrogate, also known as dllhost.exe, is a legitimate Microsoft Windows process used to run Component Object Model (COM) objects. In short, COM Surrogate allows different parts of your software to communicate so they all work together.

Think of it like a washing machine. You have to set the temperature, spin cycle, timer, and agitation level. COM Surrogate would allow all those settings to tell the agitator, drum, water inlet valves, and drain pump when to add water and at what temperature, when to wash and spin, and when to announce that the load cycle is complete.

This means that COM Surrogate is a safe process that allows your Windows PC to run smoothly. The problem, however, is when malware imitates a safe process like COM Surrogate. People who write malware frequently do this to hide their malicious code in seemingly benign processes.

The more advanced malware becomes, the more often scammers will spoof legitimate processes like COM Surrogate to allow malware to run on your machine. It is very important that you do not remove COM Surrogate or other system files if you find it running on your machine unless a legitimate antivirus program flags it. Removing legitimate COM Surrogate processes can severely damage your machine’s operations.

This may seem confusing. You don’t want to damage your computer, but you also can’t allow a virus to run. So what do you do? Let’s explore how to identify the necessary COM Surrogate process from the virus as well as the best antivirus software for the job.

What is COM Surrogate and is it a virus?

No, COM Surrogate is not a virus. However, hackers can create malicious programs called Trojans that can look like legitimate processes. This can happen with COM Surrogate.

The COM Surrogate virus is designed to discreetly install on a victim’s machine and quietly run in the background. The virus could be spyware that lies in wait, stealing personal information, banking data, and other passwords. It could also add your machine to a botnet without your knowledge for DDoS attacks.

How to detect the COM Surrogate virus

It may be hard to know if your computer is infected with a virus. If you notice performance issues with your PC, you may want to run a test to see if you can spot the virus in your machine (the virus has significant CPU usage, while the actual process uses almost none). You can also run this detection method if you notice fishy behavior on your bank account or other accounts that can access your financial information or identity.

If you don’t feel comfortable looking for the COM Surrogate process location on your own, a legitimate malware removal tool can find and remove a malicious form of COM Surrogate for you.

Even if you do locate the COM surrogate virus, we strongly advise removing it with a removal tool. The tool can locate all instances of the virus that may be hiding on your device to ensure it is completely clean.

Check your computer for the COM Surrogate virus

Legitimate COM Surrogate processes run only as “dllhost” or “dllhost.exe” and you should find those executable files in the File Explorer location “\Windows\System32” on your Windows 7, Windows 8, or Windows 10 device. A legitimate COM Surrogate process also has minimal CPU usage. If you notice any other location of these dll files or high CPU usage, you’re likely dealing with a virus.

You can check this location by opening your Windows Task Manager.

• Press CTRL + SHIFT + ESC at the same time.
• Scroll down to Background Processes.
• Right-click a COM Surrogate process (it’s normal to see more than one).
• Choose Open File Location from the menu.
• If it leads to dllhost or dllhost.exe, you’re running the legitimate process, not a virus.

How to remove the COM Surrogate virus

Again, it’s very important that you don’t attempt to remove instances of COM Surrogate on your own without a malware removal tool. COM Surrogate is a real tool that helps the different sections of your computer work together. Deleting the actual process will create significant problems and hinder your machine’s operation. Always use a removal tool.

Run a full system scan with antivirus software

To remove the COM Surrogate virus with your antivirus software, start by opening your dashboard or console. If you are still looking for a tool, here’s a list of some of the best antivirus software we’ve tested:

• TotalAV: Total AV offers automatic antivirus and malware scanning. If the system detects anything, you can "Take Action" by quarantining, removing, whitelisting, or skipping the malware.
  Get TotalAV | Read TotalAV Review
• Bitdefender: Bitdefender uses cross-platform malware protection, so it'll check your macOS devices for Windows malware and versa. It also prompts you to perform a "one-time scan" of your entire device directly after installation, which is useful if you are installing antivirus for the first time.
  Get Bitdefender | Read Bitdefender Review

• Avast: If you're looking to try out an antivirus before buying it, Avast offers free antivirus scanning and protection. If you opt for a paid plan, Avast Premium Security offers Targeted Scans, Smarts Scans, and Deep Scans, which we found easy to use.
  Get Avast | Read Avast Premium Review

Run a full scan after opening your console. This may take some time if you haven’t completed a full scan recently. It’s OK to let the scan run while you complete other tasks away from the device.

If your antivirus software is set up to automatically remove malicious files, you should be all set once the scan is complete. If your antivirus is NOT set up to automatically remove malicious files, you must remove them manually. Afterward, restart your computer and complete another scan to ensure success.

4.8

Learn More

On TotalAV's website

---

TotalAV

• High level of antivirus protection
• Protection from malicious viruses, malware and dangerous websites
• User-friendly interface and overall app
• Lacks firewall protection

Remove the virus

Follow the instructions in your console to remove the virus. It’s important to complete all of the processes your antivirus software requires. Consider setting these to automatic so the program can remove issues without your approval in the future.

Restart your computer and scan again

Restarting your computer ensures the software removed the virus and your computer is running smoothly. Then, run a second scan to ensure the software caught and removed everything.

How to avoid malware

Utilize the tools below to stay safe online. The COM Surrogate virus spreads through social engineering, malicious website links, infected attachments, and unpatched or cracked software.

Use a VPN

VPNs encrypt your data and hide your IP address to mask you from hackers.

Use antivirus software

Good antivirus software will detect, stop, and delete malicious files. Keep this patched so you’re always protected with the latest version.

Use multifactor authentication (MFA)

Turn MFA on for all your accounts where it’s available. If someone steals your credentials, this can help protect your accounts by requiring authorization from a second device.

Patch management

Regularly updating your software and installing the latest patches as they’re released will ensure you’re running the safest versions of your tools.

Learn about social engineering scams

Social engineering scams like phishing and watering hole attacks can infect your computer. Know how to spot and avoid them.

Use complex passwords

If you can, use a password generator and one of the best password managers to create strong passwords.

Monitor your accounts

It’s very important to monitor your financial and credit reporting accounts. Odd behavior may be an indication of a virus stealing your data.

Say no to links and attachments

These fall under the social engineering attack umbrella, but they’re worth mentioning again. If you don’t know where the link came from or you weren’t expecting an email with an attachment, don’t click on it.

COM Surrogate virus FAQs

Bottom line

COM Surrogate is a legitimate process running on Windows machines to allow communication between different components of the Windows operating system. It’s not a virus or malware, but it has the potential for hackers to modify it with a virus or malware hidden behind the COM Surrogate name. Never try to delete the virus or malware on your own, as you could accidentally delete one of your computer’s core operating processes.

If you see the COM Surrogate process pop up in your task manager and it’s consuming a lot of your CPU or memory resources, it is likely a virus. Use professional antivirus software or malware removal tools to eliminate all aspects of the virus from your computer.

By regularly updating your operating system and antivirus software, avoiding social engineering scams, and using good internet hygiene, you’ll greatly reduce your chances of becoming a victim of cybercrimes.

5.0

Save $105 on your first year of McAfee+ Premium

Learn More

On McAfee's website

---

McAfee

• All-in-one protection for your personal info and privacy
• Excellent antivirus protection
• Additional features like a file shredder and parental controls
• Multiple pop-ups for text notifications can be annoying

Author Details

Mary James

About the Author

Mary lives in Los Angeles and has been a cybersecurity writer for over five years. With a B.S. in Liberal Arts from Clarion University and an M.F.A. in Creative Writing from Point Park University in Pittsburgh, her career in online security began in sales and content creation for a private cybersecurity firm.