How to remove COM surrogate virus

COM surrogate virus is the malware that alters various settings and hides its purpose behind Windows processes

COM surrogate virus is a malicious version of the Component Object Model^[1] – a legitimate file used by the Windows operating system that usually runs in the background and is related to the dllhost.exe. While the initial functionality of COM is to allow the creation of COM objects used by Windows, the file that is disguising under the same name is here for much more malicious purposes.

Since 2015, hackers have started camouflaging this process to disguise malicious Trojan horses^[2], such as Trojan.Poweliks. According to reputable security vendors, a more precise name for this malicious process is Dllhost.exe 32 COM surrogate virus. The infiltration of such treats might reveal sensitive information about users and even allow hackers to steal money directly from a bank account.

Masking malicious executables by using Windows legitimate names is not a new tactic, as hackers are merely trying to mislead users to make them think that the virus is just another harmless process. In reality, any executable can be replaced, duplicated, or corrupted by malware. To separate malicious executables from legitimate processes, users should run a scan with security software and check the file's location (it should be C:\Windows\System32).

Many Windows users are looking for an answer to the question is this a virus or not. In fact, the answer is simple – the former COM surrogate is not a virus. On the contrary, it's one of the crucial Windows OS files that should not be removed under any circumstances.

However, criminals can disguise Trojan under the fake copy of the COM surrogate virus process. In fact, the ability to conceal itself under the name of a legitimate Windows process is a key feature of the Trojan. If you happen to find it in your Task manager, don't hesitate and remove it from the system.

COM surrogate virus peculiarities

Just like many other Trojan horses^[3], COM surrogate virus can be used for a long list of malicious activities, such as stealing personal information and other data which is considered sensitive. Besides, this malware can be used to help other viruses infiltrate the system, allow remote code execution, and used for many other purposes.

You should immediately check your computer using reputable anti-spyware if you suspect that it is infected with a virus. Typically, affected systems start working slower than previously, tend to crash, use an excessive amount of RAM or CPU.

Besides, you might have problems when using Microsoft Office programs, Notepad, or other applications. Finally, pay attention to suspicious programs showing up on your PC, and interrupting your browsing sessions. They can also be considered as one of the signs showing that the system is infected with a virus.

However, you should also note that these problems can be caused by many different computer viruses^[4]. Though, if you can find strange and unknown processes running in the Task Manager, you should think about COM surrogate virus removal. Take our advice and scan your PC with reputable anti-malware software. Once you get rid of the virus, scan your device with FortectIntego to repair the damage done and bring your system back to normal.

Ways to distinguish between a real and fake COM surrogate

Please, do NOT mix this entry with Dllhost.exe COM surrogate which is a critical system process used for hosting some of Windows operating system services and processes. Typically, this interface gives the ability for the developers to create COM objects that attach themselves to various programs and extend them. 

Thus, due to its specific and diverse purpose, users cannot recognize it and often confuse between the original file and the virus files. To spot a malicious Trojan horse that just impersonates a legitimate process dllhost com surrogate, you should pay attention to these tips:

• Depending on the version of the Windows OS, the original file should be located in c:\windows\system32 or c:\winnt\system32 directories;
• The virus is using a tremendous amount of your CPU power or memory while the necessary process' usage is significantly lower;
• A large number of dllhost.exe *32 operating in the Task Manager is also an indication that your computer is infected with a virus.

The COM object is used to generate thumbnail images of files in the folder and many other at first sight intangible processes. Due to this functionality, users are sometimes presented with “COM Surrogate has stopped working” error which means that they need to double-check display drivers, renew codecs, temporarily turn off anti-virus software, check the disk for errors, etc.^[5]

It seems like the problem usually occurs when browsing pictures or trying to view a video, although some reported cases are also related to printing. Nevertheless, the legitimate process is supposed to help you view thumbnails of the files and, if the service fails, users encounter “COM Surrogate has stopped working” error.

However, If you got infected with the malware that obfuscates this activity, you should not try to stop it on your own. You may end up removing essential files and cause severe damage to your computer.

For this reason, you have to employ antivirus or anti-malware software, and let your preferred software remove COM surrogate virus from the computer.

Trojan version spreads via rogue websites

Developers of the malicious process distribute it via malicious websites that might promote fake updates of regal applications. Thus, users are lured into unconsciously downloading the infected file instead of by the delusional look of it. Moreover, you should avoid illegal downloads since crooks often use them to spread trojan and other high-risk computer infections.

If that is not enough, Lesvirus.fr^[6] analysts noticed that some victims got infected via spam e-mail messages sent under the name of DHL or FedEx shipping company. The subject line stated that it failed to deliver a package and submitted an attachment with further details. Once the user opened an attachment, the Trojan infiltrated on the computer and started its malicious activity.

Thus, if you want to stay safe, you should start avoiding illegal websites, ignore suspicious emails^[7], never download their possibly infected attachments and also close all misleading ads^[8] that may show up on your way while browsing the web.

If an advertisement is offering you to update your Flash Player, FLV Player, or similar program, you should close it. If you have any doubts that you need to update these programs, you should visit their official websites. As we have already said, you should never leave this particular virus on your computer. If you have even the smallest doubts about it, please use our tips below and fix your computer.

Terminate COM surrogate virus by using anti-malware software

You should employ reliable security software to remove the virus if you want to protect your confidential data like bank logins, credit card details, passwords, and similar information. 

Remember that if you get rid of the original Windows file, you might completely damage your operating system, thus do not try to eliminate it by yourself. That's why manual COM surrogate removal is not advisable. 

To avoid making unnecessary mistakes, download a robust anti-malware and run a full system scan with it to remove COM surrogate virus from the system. In case the Trojan blocks the anti-virus scanner, follow these steps to fix that: