PROCESSMicrosoft-signed
dllhost.exeCOM Surrogate
dllhost.exe (COM Surrogate) hosts COM components in an isolated process so that if one crashes, the program that uses it survives. Windows most often uses it to generate file thumbnails in Explorer. Several instances can be normal, and high CPU usually means it is generating thumbnails for media files or a component is misbehaving.
What dllhost.exe does
Some Windows features rely on COM components that are prone to crashing, most famously the codecs and shell extensions that generate thumbnails in File Explorer. Rather than load such a component directly into a critical process, Windows runs it inside dllhost.exe, the COM Surrogate. If the component crashes, only the surrogate dies, and Explorer keeps running. That is the message behind the occasional "COM Surrogate has stopped working" dialog: a thumbnail codec crashed, contained safely.
Why several run and when usage spikes
Windows starts a dllhost.exe per group of hosted components, so a few instances can be normal. High CPU usually comes from thumbnail generation when you open a folder full of photos or videos; it subsides once the thumbnails are cached. Sustained churn, repeated crashes, or high CPU with no media activity often points to a faulty shell extension (added by a third-party app) or a bad codec pack.
Narrowing it down
- Open only a folder of media and watch whether dllhost activity correlates; if so, it is thumbnails.
- Use a shell-extension manager (such as ShellExView) to disable recently added extensions and see whether the problem stops.
- Remove unnecessary third-party codec packs, which are a frequent cause of COM Surrogate crashes.
Confirming it is genuine
Path C:\Windows\System32\dllhost.exe, Microsoft-signed. Because it deliberately hosts third-party code, the surrogate being genuine does not guarantee the component inside it is well-behaved; trace persistent problems to the extension or codec, not to dllhost itself.
Frequently asked questions
Why is COM Surrogate (dllhost.exe) using high CPU?
Most often it is generating thumbnails for images and videos in a folder you opened in Explorer, especially large media files or a folder with many of them. It settles once thumbnails are cached. A codec or shell extension that crashes repeatedly can also cause churn; disabling a recently added extension helps.
Is dllhost.exe safe?
The genuine process runs from C:\Windows\System32 and is signed by Microsoft. Because "COM Surrogate" hosts third-party components, a badly written or malicious shell extension can run inside it, so persistent problems are worth tracing to the component. Check the path and signature of dllhost.exe itself first.