What’s dllhost.exe (COM Surrogate)? Is it safe or a virus?

If your Windows PC uses DLLs (dynamic linked libraries), and yours most certainly does, then (COM Surrogate) dllhost.exe is a safe process to find running in your Windows Task Manager. In fact, I just checked my own PC as I'm writing this and dllhost.exe is running right now, two times!

I've also checked the different PCs here in our SpyShelter cybersecurity lab in Austin, Texas, and I see this dllhost.exe process running on all of them. So, what does the COM Surrogate do exactly?

dllhost.exe serves as a host for DLL (Dynamic Link Library) files. These files contain code and data that can be used by multiple programs at the same time.

The dllhost.exe process allows these shared DLLs to be executed and accessed by applications running on the Windows. This helps to improve system efficiency and reduce memory usage by allowing multiple programs to use the same resources. However, it's important to note that some malware may attempt to disguise themselves as dllhost.exe, so it's important to verify the legitimacy of the .exe.

You can verify if dllhost.exe is safe by checking to see if it's signed with the Windows Task Manager, or use our free SpyShelter Antispyware app!

Researched by Jon @ SpyShelter Labs