COM Surrogate/dllhost virus?

Spexels

Prominent
Feb 13, 2017
4
0
510
I noticed a process in task manager called COM Surrogate, after googling it seems like its a virus, I cant delete the file either, but Norton and Malware bytes don't pick anything up. It was taking up almost 50% cpu usage and I have a gaming cpu so no ordinary process should do that. It seems to have stopped now but I'm still worried
 
Solution


I do have COM Surrogate running in the background as well and I use Bitdefender Free AV. My Com Surrogate show last...

ingtar33

Honorable
Dec 17, 2012
249
0
10,910
thats part of windows.

might be able to get more information if you use Process monitor to expand out and find exactly what is running. Generally windows uses it to create Thumbnails of images and folders; if it's running hard that probably means it's choking on a corrupted file. So if you use process monitor you might be able to identify what is giving it a hard time, and delete it (if you can).
 

SumTingW0ng

Prominent
Aug 6, 2017
92
0
610


Run these following tools at full system scan.

Emsisoft Emergency Kit

HitmanPro

Malwarebytes Anti Malware

ESET Online Scanner

Kaspersky TDSSKiller

Windows Defender


 

Spexels

Prominent
Feb 13, 2017
4
0
510


Are you sure?It seems to have stopped now, that would make sense though, I was trying to create a desktop shortcut a few minutes before it happened. If it pops up again I'll see.
 

Spexels

Prominent
Feb 13, 2017
4
0
510


Now it's been replaced by another program, service host: superfetch, but this time it's at 10% cpu usage also I noticed the date modified was before I actually built the computer, does that mean it's all good?
 

SumTingW0ng

Prominent
Aug 6, 2017
92
0
610


I do have COM Surrogate running in the background as well and I use Bitdefender Free AV. My Com Surrogate show last modified is Sep 29 2017 and it using 1.2MB of RAM, everything else is 0%.

" COM stands for Component Object Model. This is an interface Microsoft introduced back in 1993 that allows developers to create “COM objects” using a variety of different programming languages. Essentially, these COM objects plug into other applications and extend them.
For example, the Windows file manager uses COM objects to create thumbnail images of images and other files when it opens a folder. The COM object handles processing images, videos, and other files to generate the thumbnails. This allows File Explorer to be extended with support for new video codecs, for example.
However, this can lead to problems. If a COM object crashes, it will take down its host process. At one point, it was common for these thumbnail-generating COM objects to crash and take down the entire Windows Explorer process with them.
To fix this sort of problem, Microsoft created the COM Surrogate process. The COM Surrogate process runs a COM object outside the original process that requested it. If the COM object crashes, it will only take down the COM Surrogate process and the original host process won’t crash. For example, Windows Explorer (now known as File Explorer) starts a COM Surrogate process whenever it needs to generate thumbnail images. The COM Surrogate process hosts the COM object which does the work. If the COM object crashes, only the COM Surrogate crashes and the original File Explorer process will keep on trucking.
“In other words”, as official Microsoft blog The Old New Thing puts it, “the COM Surrogate is the I don’t feel good about this code, so I’m going to ask COM to host it in another process. That way, if it crashes, it’s the COM Surrogate sacrificial process that crashes instead of me process.”
And, as you might have guessed, COM Surrogate is named “dllhost.exe” because the COM objects it hosts are .dll files. " - https://www.howtogeek.com/326462/what-is-com-surrogate-dllhost.exe-and-why-is-it-running-on-my-pc/

" The COM Surrogate process itself is not a virus, and is a normal part of Windows. However, it can be used by malware. For example, the Trojan.Poweliks malware uses dllhost.exe processes to do its dirty work. If you see a large number of dllhost.exe processes running and they’re using a noticeable amount of CPU, that could indicate the COM Surrogate process is being abused by a virus or other malicious application.

If you’re concerned that malware is abusing the dllhost.exe or COM Surrogate process, you should run a scan with your preferred antivirus program to find and remove any malware present on your system. If your antivirus program of choice says everything is fine but you’re suspicious, run a scan with another antivirus tool to get a second opinion. " https://www.howtogeek.com/326462/what-is-com-surrogate-dllhost.exe-and-why-is-it-running-on-my-pc/


Did you run your antivirus and second opinion scanner?
 
Solution

ingtar33

Honorable
Dec 17, 2012
249
0
10,910


Poweliks is an easy virus to spot and every major AV can see it. It was a pain in the butt for us IT guys back in 2015. heck you can see it too. just check your users\youruserfolder\appdata\local\temp folder and see if there are tens or hundreds of thousands files which are nothing more then chains of folders spawning endlessly.
 

leigh76

Distinguished
Jan 27, 2009
19
0
18,570
jXC8386.png


This does not mean there is no problem, just showing it does run on other machines too ;)