What Is dllhost.exe in Windows? COM Surrogate Explained

Overview

What Is dllhost.exe? Meaning of COM Surrogate in Windows

dllhost.exe is a legitimate Windows system process. In Task Manager it is usually displayed as COM Surrogate. Its job is to host certain COM components outside the main application that requested them. In simple terms, Windows uses dllhost.exe as a helper container for code that should run separately from File Explorer, media apps, system tools, or other programs.

The name dllhost means “DLL host.” A DLL file is a dynamic-link library: a file that contains reusable code for Windows or installed programs. Some DLL-based components cannot run directly as normal applications, so Windows starts dllhost.exe to load and execute them safely.

ℹ️

Quick Answer If you see COM Surrogate or dllhost.exe in Task Manager, it is usually normal. It is most commonly used when Windows generates thumbnails, previews media files, works with codecs, or runs COM components in a separate process.

What Does dllhost.exe Do?

The process can be involved in several background tasks:

Task	What It Means
Thumbnail generation	Creates previews for images, videos, documents, and other files in File Explorer.
COM component hosting	Runs Component Object Model objects outside the program that requested them.
Shell extensions	Supports third-party extensions added to File Explorer context menus, previews, or properties windows.
Media metadata reading	Helps Windows read video, photo, and audio information through codecs and handlers.
Crash isolation	Prevents some component crashes from taking down File Explorer or another main application.

Purpose

Why Is dllhost.exe Needed in Windows 10 and Windows 11?

The main reason Windows uses dllhost.exe is stability. Some components that Windows needs are implemented as COM objects. If they were loaded directly inside File Explorer and one of them crashed, File Explorer could crash with it. By placing the component inside dllhost.exe, Windows creates a separation layer.

This is why the process is called COM Surrogate: it acts as a surrogate process for COM objects. The component does its work inside dllhost.exe, while the main program communicates with it from the outside.

✅

Why It Matters COM Surrogate improves reliability. If a faulty codec, thumbnail handler, or shell extension fails, Windows can often terminate only the dllhost.exe instance instead of crashing the entire desktop shell.

Common Situations Where dllhost.exe Starts

You open a folder with many photos or videos.
File Explorer creates large icons, previews, or thumbnails.
You open file properties for a media file.
A third-party codec pack processes video metadata.
A program uses an older COM-based extension or plugin.
Windows reads metadata from files stored on an external drive or network share.

Safety Check

Is dllhost.exe Safe, or Could It Be Malware?

The real dllhost.exe is safe. It is a standard Microsoft Windows component. However, malware can use similar names to look trustworthy, and malicious software may also abuse COM-related mechanisms. For that reason, you should check the file location and digital signature if the process behaves suspiciously.

Press Ctrl + Shift + Esc to open Task Manager.
Go to the Processes tab or the Details tab.
Find COM Surrogate or dllhost.exe.
Right-click it and choose Open file location.
Verify that the file is located in C:\Windows\System32\.
Right-click the file, open Properties, and check the Digital Signatures tab. The signer should be Microsoft Windows or Microsoft Corporation.

✅

Legitimate Location The genuine 64-bit system file is normally located here:
C:\Windows\System32\dllhost.exe

🚨

Suspicious Signs Treat the process as suspicious if it runs from C:\Users\, C:\ProgramData\, C:\Temp\, an unknown folder, or a folder with a random name. Also be careful if the file has no Microsoft digital signature.

File Details

dllhost.exe File Location, Signature, and Normal Properties

On a standard Windows installation, dllhost.exe is stored in the Windows system directory. On 64-bit versions of Windows, you may also see a 32-bit copy used for 32-bit COM components.

# Main 64-bit Windows system file:
C:\Windows\System32\dllhost.exe

# 32-bit compatibility copy on 64-bit Windows:
C:\Windows\SysWOW64\dllhost.exe

Property	Expected Value
Process name	dllhost.exe
Task Manager name	COM Surrogate
Publisher	Microsoft Corporation
Main path	`C:\Windows\System32\dllhost.exe`
Compatibility path	`C:\Windows\SysWOW64\dllhost.exe`
Startup behavior	Started on demand by Windows or applications
Can it be removed?	No, it is a system component

ℹ️

System32 vs SysWOW64 On 64-bit Windows, System32 contains 64-bit system files, while SysWOW64 contains many 32-bit compatibility files. Seeing dllhost.exe in both folders can be normal.

Task Manager

Why Are There Multiple dllhost.exe or COM Surrogate Processes?

It is normal to see more than one COM Surrogate process. Windows can start a separate dllhost.exe instance for different COM components, user sessions, bitness requirements, or isolation boundaries. For example, one instance may be handling thumbnails, while another is hosting a different shell extension.

Multiple instances are not automatically a sign of malware. The important factors are the file location, digital signature, parent process, and resource usage pattern.

When Multiple dllhost.exe Processes Are Normal

You are browsing folders with many image or video files.
File Explorer is set to show large icons or preview panes.
You recently installed media software, codecs, cloud storage clients, archivers, or file managers.
A program uses old COM-based plugins.
You have both 32-bit and 64-bit applications working with shell components.

When You Should Investigate

One instance constantly uses high CPU while the PC is idle.
Many instances appear from a non-Windows folder.
The process starts immediately after boot and connects to unknown network addresses.
Your antivirus reports suspicious COM activity.
File Explorer crashes whenever you open a specific folder.

Performance

dllhost.exe High CPU, Memory, or Disk Usage — Common Causes

In normal operation, dllhost.exe usually uses little CPU and memory. Temporary spikes are common when Windows is generating thumbnails or reading media metadata. Persistent high usage usually points to a damaged media file, a problematic codec, a broken shell extension, or malware.

Cause	Typical Symptoms	What to Check
Corrupt video or image file	CPU rises when opening one specific folder	Move files out in small groups to find the problematic file
Faulty codec	High CPU with video thumbnails or previews	Uninstall codec packs or update media software
Broken shell extension	Explorer freezes, crashes, or right-click menu is slow	Disable third-party shell extensions
Thumbnail cache problem	Repeated thumbnail rebuilding and disk activity	Clear the thumbnail cache
Network or external drive issue	Slow Explorer when browsing remote folders	Test with the drive disconnected or network path unavailable
Malware	Wrong file path, no signature, strange network activity	Run a full security scan

⚠️

Important Do not assume dllhost.exe itself is the problem. In many cases, it is only the host process. The real cause may be a codec, preview handler, file, or shell extension loaded inside it.

Fixes

How to Fix dllhost.exe High CPU or COM Surrogate Errors

Try the following methods in order. Start with the safest steps and move to deeper troubleshooting only if the problem returns.

Fix 1 — Restart File Explorer

Press Ctrl + Shift + Esc to open Task Manager.
Find Windows Explorer.
Right-click it and choose Restart.
Check whether COM Surrogate returns to normal CPU usage.

Fix 2 — Clear the Thumbnail Cache

Press Win + R, type cleanmgr, and press Enter.
Select the system drive, usually C:.
Check Thumbnails.
Click OK and confirm deletion.
Reopen the folder that caused the problem.

You can also clear thumbnails through Settings → System → Storage → Temporary files in Windows 10 and Windows 11.

Fix 3 — Find a Problematic Media File

Open the folder where dllhost.exe usage spikes.
Switch File Explorer to Details view instead of large icons.
Move half of the files to a temporary folder.
Check whether the CPU spike stops.
Repeat the process until you identify the file that triggers the issue.

ℹ️

Tip Large MKV, AVI, MP4, MOV, RAW photo, and partially downloaded files are common triggers because Windows tries to read metadata and generate thumbnails for them.

Fix 4 — Disable Thumbnails Temporarily

Open File Explorer.
Click View → Options or More → Options.
Open the View tab.
Enable Always show icons, never thumbnails.
Click Apply and OK.

If high CPU usage stops after this change, the issue is probably related to thumbnails, codecs, or media preview handlers.

Fix 5 — Disable Problematic Shell Extensions

Third-party shell extensions can add context menu items, preview handlers, property handlers, cloud sync overlays, and archive tools to File Explorer. If one of them is broken, COM Surrogate or Explorer may become unstable.

Use a trusted shell extension manager such as ShellExView from NirSoft.
Sort extensions by Company.
Disable non-Microsoft extensions in small groups.
Restart File Explorer after each change.
Re-enable extensions one by one to find the faulty item.

Fix 6 — Remove or Update Codec Packs

If the problem appears when opening folders with videos, update or uninstall third-party codec packs. Modern Windows can handle many common media formats without large codec bundles, and outdated packs are a frequent cause of COM Surrogate crashes.

Fix 7 — Run System File Checker and DISM

Open Command Prompt as Administrator and run:

sfc /scannow

If SFC reports errors that it cannot repair, run:

DISM /Online /Cleanup-Image /RestoreHealth

After DISM finishes, run sfc /scannow again and restart the PC.

Fix 8 — Scan for Malware

Open Windows Security.
Go to Virus & threat protection.
Choose Scan options.
Run a Full scan.
If you suspect a serious infection, run Microsoft Defender Offline scan.

Disable or Delete

Can You Disable or Delete dllhost.exe?

You should not delete dllhost.exe. It is part of Windows and is required for normal COM functionality. Removing it can break File Explorer previews, shell features, legacy applications, and system components.

You can end a specific COM Surrogate process temporarily in Task Manager, but Windows or an application may start it again when needed. Ending it is useful only when it is stuck or consuming high CPU because of a problematic file or extension.

✓ Safe Actions

Restart File Explorer
Clear thumbnail cache
Disable thumbnails temporarily
Remove broken codecs
Disable third-party shell extensions
Run SFC, DISM, and antivirus scans

✗ Avoid These Actions

Deleting dllhost.exe from System32
Replacing it with a file from the internet
Disabling random COM services without knowing their purpose
Changing permissions on protected Windows folders
Killing every dllhost.exe instance repeatedly instead of finding the cause

🚨

Do Not Download dllhost.exe Never download dllhost.exe from DLL download sites or forums. If the original file is damaged, use sfc /scannow, DISM, Windows Update, or an in-place repair install.

FAQ

Frequently Asked Questions About dllhost.exe and COM Surrogate

Q Is dllhost.exe a virus? ▼

No. The real dllhost.exe is a Microsoft Windows system file. It becomes suspicious only if it is located outside the Windows system folders, lacks a Microsoft digital signature, or behaves like malware.

Q Why does Task Manager show COM Surrogate instead of dllhost.exe? ▼

Task Manager shows the friendly name COM Surrogate because dllhost.exe acts as a surrogate host process for COM objects. On the Details tab, you can still see the executable name dllhost.exe.

Q Can I end COM Surrogate in Task Manager? ▼

Yes, you can end a stuck instance. It is generally safe, but you may lose a thumbnail generation task, preview operation, or metadata reading operation. Windows may start a new instance automatically.

Q Why does dllhost.exe use the internet? ▼

dllhost.exe itself is not normally a web-browsing component. If you see network activity, check which component is hosted inside it, verify the file location, and scan the system. Some legitimate COM components can communicate online, but unexplained network traffic deserves investigation.

Q Why does dllhost.exe crash when I open a folder? ▼

The most common reasons are a corrupt media file, a faulty codec, or a broken shell extension. Switch the folder to Details view, clear the thumbnail cache, and test files in smaller groups to find the trigger.

Q Is dllhost.exe related to rundll32.exe? ▼

They are different Windows components. dllhost.exe hosts COM objects, while rundll32.exe runs specific functions exported from DLL files. Both can be legitimate, and both are sometimes imitated by malware.

Q Should I block dllhost.exe in the firewall? ▼

Blocking it globally is not usually recommended because it may affect legitimate COM-based features or applications. First identify why it is making a connection. If the file path is suspicious, treat it as a malware issue rather than a firewall configuration issue.

Conclusion

Conclusion: Should You Worry About dllhost.exe?

In most cases, dllhost.exe is a normal and necessary Windows process. It appears as COM Surrogate because Windows uses it to host COM components separately from the programs that request them. This improves stability and helps File Explorer handle thumbnails, previews, metadata, codecs, and shell extensions.

You should investigate dllhost.exe only when it runs from the wrong folder, has no Microsoft signature, consumes high CPU for a long time, crashes repeatedly, or appears together with other signs of infection. For performance problems, the best approach is to find the component loaded inside COM Surrogate: thumbnails, codecs, corrupt media files, and third-party shell extensions are the usual suspects.

✅

Bottom Line dllhost.exe is safe when it is located in C:\Windows\System32\ or C:\Windows\SysWOW64\ and signed by Microsoft. Do not delete it. If it causes high CPU or crashes, troubleshoot thumbnails, codecs, shell extensions, and malware instead.