Dllhost.exe – what is this process?
Dllhost.exe is a Windows system process designed to process COM objects. In addition, he is responsible for managing processes grouped in Internet Information Services (IIS), participates in loading the .NET runtime environment, and also manages programs that use DLLs. This is why you may encounter multiple COM Surrogate processes (dllhost.exe) running concurrently in Task Manager.
In general, dllhost.exe is a host for some executable files and DLLs. Many people mistakenly consider it to be a source of high load on the processor and RAM. The problem is not caused by the host process, but by the loaded DLL file that is currently using it.
By default, dllhost.exe is located in the C:\Windows\System32 folder. Therefore, when a process begins to overuse system resources, first check if it is located in this folder using the Task Manager. Open the latter by pressing Ctrl + Shift + Esc and on the Processes tab, find COM Surrogate. If more than 4 processes are running and there is “*32” at the end, most likely you are dealing with a virus.
To check, look where the file is located. Right-click on the process and select Open File Location. If it is located in a different location, then you are most likely encountering malware or adware.
Troubleshooting methods
We offer several ways to correct the situation. Let's start by eliminating the most common errors.
Uninstalling codecs
Click “Start” - “Control Panel” (or for Windows 10, type the phrase in “Search” and select “Classic application”). Then look for “Multimedia and Sound” - “Hardware”. You will see two folders: “Audio Codecs” and “Video Codecs” - choose depending on what you were running before you saw the error message. You need to select the codec, click “Properties” and “Delete”. If a notification appears that you need to reboot the OS, you need to do this so that no elements are left behind, which could cause problems in the future.
System codecs are uninstalled like this:
Go to the “Add or Remove Programs” tab – “Windows Installation” – “Multimedia” – “Composition”. Next, refuse video and audio compression by unchecking the appropriate boxes.
Disable DEP
If the system is dangerously overloaded with the Dllhost.exe process, you can temporarily disable its execution (until the true cause of the failure is found). Go to “Windows Search” – “Control Panel” – “System and Security” – “Advanced Settings” – “Performance” – “Settings” – “Data Execution Prevention”.
Check the second line where you are asked to select for which programs DEP will be disabled. Enter “C:\Windows\System32\dllhost.exe” in the field. Now check the “Task Manager” to see if the system has unloaded after these manipulations.
Virus check
It is likely that the incorrect operation of COM Surrogate is due to a viral infection of the OS. Launch your antivirus and select deep scan. The built-in System Defender in Windows will not be enough here. It’s better to download the full or portable version of some serious program, for example, Doctor Web, Kaspersky Anti-Virus, Avast, etc. If nothing helps, you can use the CCleaner utility to check if any Some program error when registering its elements in COM Surrogate. To do this, open the main menu of the application and the “Registry” section. Left o and start analyzing. A list of problematic components will appear, select all and click “Fix”.
You can also restore the system through access points. Go to “Control Panel”, change the view mode to “Icons” and select “Recovery”. Here you can agree to what is recommended or set your own date and time, if you remember exactly when everything worked properly.
Checking your computer for viruses
There are many viruses that can masquerade as system processes to spread malicious code. If you see a lot of running dllhost.exe with the ending “*32”, which heavily loads the processor, then this indicates that a malicious application is running under the COM Surrogate process.
Here is a list of viruses that are hidden under COM Surrogate: Artemis!895C95A0B930, Worm/Loveelet-DR, Win64:Malware-gen, Worm/Nachi.A1.
Some of them make system resources work by mining for various cryptocurrencies. So check Windows with a powerful security scanner. Among the free antiviruses, we recommend using Malwarebytes, which can perform a full scan.
After the scan is completed, restart your computer regardless of the result. If COM Surrogate continues to consume CPU and RAM resources, move on to the next method.
Why COM Surrogate loads the processor
When you enter the Task Manager, you probably notice that dllhost.exe is using a lot of CPU. This happens for several reasons:
- you tried to view a file whose structure was broken;
- the computer is infected with malware;
- components encoding or decoding data are damaged or outdated (they are needed to display information correctly, for example, so that the picture on the screen looks exactly like an image, and not like a set of letters, numbers and symbols or an empty window with an error message);
- the program (photo viewer, graphic editor, player through which you open files, etc.) incorrectly registered elements that should communicate with COM Surrogate.
Run System File Checker
High CPU load caused by the dllhost.exe process can occur as a result of corrupted system files. To do this, we will check the integrity of the OS using the SFC and DISM commands. The first, if damaged components are detected, overwrites them with working copies from local storage.
Open a command prompt by typing “cmd” into the Windows search box and then running the result as an administrator.
In the console, run the command:
sfc /scannow
The scanning may take a long time, do not interrupt it and wait until it is completed. Then run the DISM utility, which uses external Microsoft servers to download the copies required to replace the damaged ones. Therefore, before starting, connect to the Internet and run the command:
DISM.exe /Online /Cleanup-image /Restorehealth
Do not close the command prompt until the scan reaches 100%.
What harm can be caused by failures in this process?
Since the corresponding program is necessary for the functioning of many applications, its emergency closing leads to disruptions in the operation of these programs.
Some of them may crash during use, others may not open at all, and others may work stably until a certain function is activated in them. In general, the behavior of programs on a computer will be difficult to predict. Therefore, it is better not to put off solving the problem, but to deal with it immediately after discovery. I think you understand what this strange process called COM Surrogate is, let’s now talk about eliminating the error.
Create a new account
In many cases, the load generated by the COM Surrogate process is due to a corrupted user profile. So try creating a new account and check if the COM Surrogate process is using up RAM and CPU resources.
If you are using Windows 10, go to the “Family and other users” tab using the ms-settings:otherusers command from the Win + R dialog box.
Click the plus to add a user for this computer and follow the instructions in the account creation wizard. In the next window, click on the link “I don’t have this person’s login information.” Then add a user without Microsoft data, enter your username and password, and confirm the creation of a new account.
Then restart your computer and log in under the newly created profile. Check in the Task Manager to see if dllhost.exe is loading system resources, in particular the processor and memory.
If you are using Windows 7, enter mmc in the system search bar and go to the Microsoft Management Console with administrator rights.
Go to File - Add/Remove Snap-in.
In the Snap-in window, select Local Groups and Users, then click Add.
In the window that opens, specify your local computer and click “Finish.”
If an added entry appears under the selected snap-ins, click “OK” to close the window. In the left pane, click on “Local Users and Groups”, then on “Users”. Then go to the top "Action" menu and select "New User".
Enter the details for the new profile and click on “Create”. Then restart your computer and sign in to your new account. If the CPU load has dropped to normal, transfer your personal data to a new profile.
COM Surrogate stopped working on Windows 10
Press Win+R and enter sysdm.cpl to open system properties.
Next, go to the “Advanced” tab and click on “Options”.
Go to the Data Execution Prevention tab and click Turn on DEP for all programs and services except those selected below . Next, click “Add”.
For 32-bit Windows system : Go to the system32 and open the dllhost.exe file. Click OK and restart your computer.
For 64-bit Windows system : Go to the SysWow64 and open the dllhost.exe file. Click OK and restart your laptop.
See also:
- sihost.exe in Windows 10 - What is it and how does it work
- LSASS.exe: what is it and how does it work in Windows 10
- What is the AppData folder in Windows and what is it for?
- What is the WSAPPX process and how does it affect the processor and hard drive in Windows 10
- Fix DPC Watchdog Violation Error on Windows 10
comments powered by HyperComments
System Restore
If dllhost.exe continues to consume the CPU, try resetting the system to a previous state to the point that was created before the high resource load occurred.
Open the recovery wizard with the rstrui command from a Win + R window.
On the second screen, select a system snapshot that was taken before heavy CPU and RAM usage began.
In the next window, click on “Finish” to start the recovery process. After an automatic reboot, the OS will be returned to its previous state. If recovery fails, repeat the process and select another point. Then check if the CPU load generated by COM Surrogate is back to normal.
How to disable COM Surrogate dllhost.exe
You cannot disable this process because it, like many others, is an important part of the operating system. COM Surrogate is necessary for the stable operation of your computer. In short, dllhost.exe is just a container containing COM objects necessary for other system processes. This is an insurance system that prevents more important processes from crashing when a COM object crashes. Without it, Windows applications and services would be much more unstable. Each COM Surrogate instance contains the necessary libraries of individual applications running on your computer.
How could the COM surrogate virus infect my computer?
This Trojan horse is distributed using various techniques. Unfortunately, some of them have not yet been identified, so you need to thoroughly check the security status of your computer if you want to be sure that your machine is 100% protected.
Please make sure you have the latest version of your antivirus and antispyware software. These programs will help you prevent the penetration of Dllhost.exe *32 COM surrogate virus and other cyber threats. In the meantime, the discussion about preventing the entry of said cyber threat is not over.
If you want to stay safe, you should avoid illegitimate sites, ignore suspicious email messages and never download potentially infected attachments, and close any misleading advertisements you may encounter while browsing your web browser. If an advertisement prompts you to update your Flash player, FLV player or similar program, you must close it.
If you still think that you need to update the programs, then you should visit their official websites. As we have already said, you should never leave the COM surrogate virus on your computer. If you have the slightest suspicion about its presence, please use the tips below and debug your computer.
Method #2: cleaning with an antivirus scanner
Select one of the solutions below and follow the instructions provided:
Microsoft Security Essentials
Free antivirus from the creators of Windows. Skillfully determines which process in the system is “one’s own” and which is “foreign.” Protects in real time against spyware and adware, worms and Trojans. Consumes a meager amount of PC resources. Works in the background. Almost completely automated: does not distract the user with frequent requests to launch an update or perform cleaning.
1. On the official product page (https://windows.microsoft.com/ru-ru/windows/security-essentials-download) click the “Download” link.
2. Run the installer with administrator rights.
3. Under the terms and conditions of the agreement, click “I accept.”
4. Click the “Join...” button to join the product improvement program, or the “I don’t want...” button to opt out of the program.
5. Click Next.
6. If you do not use a third-party firewall (only a system one), do not uncheck the “If there are none...” setting. Click “Next” again.
7. When launched for the first time, the antivirus will automatically start updating its databases (the “Update” tab). Wait for it to complete.
8. Go to the main tab (Home).
9. In the “Scan Settings” list, set the value to “Custom”.
10. To start the scan, click “Check Now”.
11. Remove the virus and other potentially dangerous items found by Microsoft Security Essentials.
Malwarebytes Anti-Malware
One of the best programs to combat computer malware. Distributed shareware free of charge. The commercial version of the product can protect PCs in real time. Anti-Malware is capable of looking for worms and Trojans in all “corners” of the operating system and its registry, in disk partitions.
1. Open in your browser - https://ru.malwarebytes.org.
2. Go to the “Home” section and click “Free Download”.
3. Install the downloaded distribution kit into the system.
4. In the utility window, on the “Information Panel” tab, click “Check for updates.”
5. After the update, open the “Check” tab.
6. Select the scan mode “Full...” or “Custom...” (additional configuration required).
7. Run the scan (the “Scan” button).
8. Neutralize detected elements.
