COM Surrogate
dllhost.exe is safe. It's the COM Surrogate process that runs COM objects outside of the requesting process, preventing crashes from affecting the entire system.
dllhost.exe (COM Surrogate) is a Windows system process that hosts COM (Component Object Model) objects. When programs need to run COM components - especially those that generate file thumbnails or previews - Windows uses dllhost.exe as a separate "sandbox" process.
The key purpose is crash protection: if a COM object fails or crashes (common with video codecs or image handlers), only the dllhost.exe process crashes instead of File Explorer or the calling application.
Common Use: Most often seen when browsing folders with images or videos - dllhost.exe generates thumbnail previews so File Explorer doesn't have to.
dllhost.exe runs when Windows needs to execute COM objects safely:
Multiple instances (5-10+) are normal when browsing folders with many media files.
The legitimate dllhost.exe is NOT a virus. However, malware frequently impersonates this process because it's unfamiliar to users and crashes are expected behavior.
C:\Windows\System32\. Any other location is malware.Common Malware: Fake dllhost.exe files in AppData, Program Files, or Temp folders are often cryptocurrency miners or Trojans. Always verify location first.
You cannot disable dllhost.exe, and doing so would break file thumbnails and previews throughout Windows.
Note: Frequent "COM Surrogate has stopped working" errors indicate a problem with installed codecs or shell extensions, not with dllhost.exe itself.
If crashes stop, a codec or shell extension is the problem.
C:\Windows\System32\dllhost.exesfc /scannow (wait 10-30 minutes)DISM /Online /Cleanup-Image /RestoreHealthBest Fix: Frequent crashes are almost always caused by third-party video codecs. Uninstall all codec packs and reinstall a fresh copy.