Is COM Surrogate a Virus or a Legitimate Process?

COM Surrogate, also known as dllhost.exe, is a legitimate Microsoft Windows process used to run Component Object Model (COM) objects. In short, COM Surrogate is a safe process that allows different parts of your software to communicate so they all work together.

The problem, however, is when malware imitates a safe process like COM Surrogate. People who write malware frequently do this to hide their malicious code in seemingly benign processes. It is very important that you do not remove COM Surrogate or other system files if you find it running on your machine unless a legitimate antivirus program flags it. Removing legitimate COM Surrogate processes can severely damage your machine’s operations.

This may seem confusing. You don’t want to damage your computer, but you also can’t allow a virus to run. So what do you do? Let’s explore how to identify the necessary COM Surrogate process from the virus as well as the best antivirus software for the job.

5.0

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Learn More

On Avast's website

Antivirus Software

Avast

• Perfect third-party test results, verifying comprehensive antivirus, ransomware, and malware protection
• Includes advanced security features like a VPN, firewall, data breach alerts, privacy tools, device optimization, and more
• Lackluster customer support

What is COM Surrogate and is it a virus?

No, COM Surrogate is not a virus. However, hackers can create malicious programs called Trojans that can look like legitimate processes. This can happen with COM Surrogate.

The COM Surrogate virus is designed to discreetly install on a victim’s machine and quietly run in the background. The virus could be spyware that lies in wait, stealing personal information, banking data, and other passwords. It could also add your machine to a botnet without your knowledge for DDoS attacks.

How to detect the COM Surrogate virus

As with most viruses, you can tell your computer is infected with a virus by running an antivirus scan. It's recommended that you let these scans run on a schedule so you can be sure that your computer is being checked every so often. The top-rated antivirus program that we tested is Avast.

If you want to manually detect the virus, you can check the Task Manager on your computer. While the real COM Surrogate uses almost no processing power, the virus would be using a significant amount. It's also always located in the System32 folder (usually called dllhost).

To verify these two aspects of the real COM Surrogate program, simply:

1.  Right click on your task bar and click Task Manager to open the program up.
2. Look for COM Surrogate, dllhost, or dllhost.exe in the list of processes (it's normal for more than one of them to appear in the list).
3. Check how many resources it's using in CPU, Memory, or Disk columns.
4. If any instance is using very little resources (less than 1 MB of our memory) then it's likely the real program.



5. Then, right-click the COM Surrogate processes. 

6. Choose Open File Location from the menu.

7. If it leads to dllhost or dllhost.exe located in the File Explorer location “\Windows\System32”, you’re running the legitimate process, not a virus.

If you don’t feel comfortable looking for the COM Surrogate process location on your own, a legitimate malware removal tool can find and remove a malicious form of COM Surrogate for you.

Even if you do locate the COM surrogate virus, we strongly advise removing it with a removal tool. The tool can locate all instances of the virus that may be hiding on your device to ensure it is completely clean.

How to remove the COM Surrogate virus

The safest way to remove the COM Surrogate virus is with antivirus software. Simply open your preferred antivirus program and choose the option to run a full scan. This may take some time, but it's OK to let the scan run while you complete other tasks away on the device.

If your antivirus software is set up to automatically remove malicious files, you should be all set once the scan is complete. If your antivirus is NOT set up to automatically remove malicious files, it'll identify the files for you and allow them to either quarantine or delete them. Afterward, restart your computer and complete another scan to ensure success.

Here’s a list of some of the best antivirus software we’ve tested so you can feel secure that your system is safe:

Antivirus
Star rating	4.3 AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.	4.0 AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.	4.3 AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.
Price	$29.00–$49.00/yr (first year only)	$29.99–$249.99/yr	$29.99–$99.99/first yr
# of devices protected	4 - 8	Unlimited	1 - 10
Malware scans	Manual and scheduled	Manual and scheduled	Manual and scheduled
Real-time protection
EICAR test results	2/3	3/3	3/3
Firewall
Phishing protection
Compatibility	Windows, Mac, Android, iOS, Chrome, Edge, Opera, Safari	Windows, Mac, Android, iOS, Chrome, Firefox, Safari, Edge	Windows, Mac, Android, iOS
Extras	Password manager, ad blocker, VPN	Parental controls, performance optimization tools, VPN	Password manager, VPN, dark web monitoring, parental controls, privacy monitor, identity theft protection, cloud backup
24/7 customer support
Learn more	Get TotalAV	Get McAfee	Get Norton 360

Again, it’s very important that you don’t attempt to remove instances of COM Surrogate on your own without a malware removal tool. COM Surrogate is a real tool that helps the different sections of your computer work together. Deleting the actual process will create significant problems and hinder your machine’s operation. Always use a removal tool.

How to avoid malware

Utilize the tools below to stay safe online. The COM Surrogate virus spreads through social engineering, malicious website links, infected attachments, and unpatched or cracked software.

1. Use a VPN: VPNs encrypt your data and hide your IP address to mask you from hackers.
2. Use antivirus software: Good antivirus software will detect, stop, and delete malicious files. Keep this patched so you’re always protected with the latest version.
   
3. Use multifactor authentication (MFA): Turn MFA on for all your accounts where it’s available. If someone steals your credentials, this can help protect your accounts by requiring authorization from a second device.
   
4. Patch management: Regularly updating your software and installing the latest patches as they’re released will ensure you’re running the safest versions of your tools.
   
5. Learn about social engineering scams: Social engineering scams like phishing and watering hole attacks can infect your computer. Know how to spot and avoid them.
   
6. Use complex passwords: If you can, use a password generator and one of the best password managers to create strong passwords.
   
7. Monitor your accounts: It’s very important to monitor your financial and credit reporting accounts. Odd behavior may be an indication of a virus stealing your data.
   
8. Say no to links and attachments: If you don’t know where the link came from or you weren’t expecting an email with an attachment, don’t click on it.

COM Surrogate virus FAQs

Bottom line

COM Surrogate is a legitimate process running on Windows machines to allow communication between different components of the Windows operating system. It’s not a virus or malware, but it has the potential for hackers to modify it with a virus or malware hidden behind the COM Surrogate name. Never try to delete the virus or malware on your own, as you could accidentally delete one of your computer’s core operating processes.

If you see the COM Surrogate process pop up in your task manager and it’s consuming a lot of your CPU or memory resources, it is likely a virus. Use professional antivirus software or malware removal tools to eliminate all aspects of the virus from your computer.

By regularly updating your operating system and antivirus software, avoiding social engineering scams, and using good internet hygiene, you’ll greatly reduce your chances of becoming a victim of cybercrimes.

No Fuss, Real-Time Online and Mobile Protection

4.3

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Learn More

On TotalAV's website

Antivirus Software

TotalAV

First year discount on paid plans

• Real-time protection from viruses, malware, and online threats
• Blocks tracking cookies and ads, proactively monitors for data breaches, and option to schedule smart scans
• 100% compatible with Windows, Mac, Android, and iOS operating systems on up to 3 devices
• Lacks firewall protection

Author Details

Mary James

About the Author

Mary is a seasoned cybersecurity writer with over seven years of experience. With a B.S. in Liberal Arts from Clarion University and an M.F.A. in Creative Writing from Point Park University, she educates audiences on scams, antivirus software, and more. Her passion lies in educating audiences on helpful ways to protect their data.