Despite the powerful modern computer configurations and relatively stable operating systems, almost every Windows user of the latest versions was faced with a sudden message that the COM Surrogate program was stopped . Why such problems arise and how to deal with them, read on.
COM Surrogate (Windows 7) - what is it?
Naturally, when messages of this kind appear, the user immediately wonders about the virus exposure and tries to frantically search for such a process in the “Task Manager” with an attempt to stop it. Unfortunately, this does not lead to anything, since such a process is simply not there. But after all, the error clearly indicates the service in which the operation failed.
The Windows 7 COM Surrogate service itself, in its original version, is mainly focused on the implementation of COM + components in the ISS environment (Internet connection, playback of certain types of multimedia files, etc.). But this is only a general case.
Why does the error “COM Surrogate program stopped working” appear?
The essence of the problem boils down to the fact that some programs using standard .NET libraries incorrectly access computer resources. There may be a “crash” of applications during operation, at startup, or normal operation until a certain point at which an unrecoverable syntax error appears that causes code execution to loop (for example, when trying to play “broken” media files). Yes, and the blue screen pops up.
On the other hand, it is often noted that the COM Surrogate program may not be a system process, but a virus that masquerades as a virus. Its effect is that the consumption of system resources begins to go through the roof (processor load can reach 95-100%, although for a standard service, in theory, the CPU load usually does not exceed 50% even if it does not work correctly).
How to find out that it is not a virus?
If for some reason the user receives a message that COM Surrogate has stopped working, first you need to check if the virus caused such a system reaction. For the functioning of the service itself, the dllhost process, represented as the executable of the same name as the EXE file, is responsible.
First, open the “Task Manager”, find the specified service on the process tab (there may be several of them, depending on the number of running applications using the above components), and through RMB go to the point where the file location is opened. If this is an original process, the System32 folder (for systems with x86 architecture) or SysWOW64 folder (for 64-bit systems) will be indicated. Any other location immediately indicates the presence of the virus.
Multimedia issues
As for multimedia, most often problems with COM Surrogate are observed when starting and closing players (mainly KMPlayer), not to mention playing damaged files.
Many experts attribute this to the presence in the system of outdated codecs from the K-Lite and The HDvid kits. The simplest solution to the problem will be the standard removal of these packages (you can use the programs and components section in the Control Panel) with the subsequent installation of a more recent version.
Troubleshooting Service Issues
However, in most cases, COM Surrogate service failures can be addressed by a more universal method. To do this, you need to use the system section in the "Control Panel", go to the "Advanced" tab and click the settings button.
Next, the Data Execution Prevention tab is used, on which the DEP enable line is activated for all services and programs except the selected ones. In the window below, by clicking the add service button, you must specify the full path to the dllhost file and save the changes, and then reboot the system.
If this does not help, use online system recovery. First, the scan command (DISM.exe / Online / Cleanup-image / ScanHealth) is entered in the command console launched as an administrator, and then the recovery (DISM.exe / Online / Cleanup-image / RestoreHealth) is performed directly.
Virus removal
But, as already mentioned, COM Surrogate can be a virus. If this is true (see the file location), and the scan with the anti-virus scanner did not work, first we reboot the system in safe mode and use any means of verification. Microsoft Security Essentials with a special scan mode is a good help.
If you delete the threat in manual mode, you must use the registry editor (regedit), set the search with input as the value {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}, and completely delete the found section. This is followed by a standard reboot.
Just in case, it is advisable to check the browser add-ons, as well as track the path to the executable file (it should end only with the .exe extension). If something else is added at the end, all this needs to be deleted and the changes saved.
What should you do in no case?
Some users, when a service crashes, naively believe that they can be eliminated by terminating all dllhost processes and deleting the file of the same name from its original location. Terminate processes - applications using them hang. Delete the file - the system will generally stop working. The original process can only be completed if all programs are closed (but the process is still active). But you cannot deal with file deletion. This will cause so many additional errors that sometimes only a complete reinstallation of the system can help.
Brief summary
As you can see, problems with this service can be found quite often. Of course, for the most part they are connected with multimedia, less often with the Internet, when browsers start to freeze. To fix problems, if it really relates to playing video or audio, it is better to use the indicated methods, for all other cases you will have to use exceptions for the DEP service.