COM Surrogate & Windows Explorer high CPU and memory usage

Question

Hi all,

In the past few months I have been experiencing a performance issue. Every now and then when I open a windows explorer window, it takes a few minutes while the "address" bar seems to be loading until the contents and the icons in the left pane appear. While it's loading, Windows Explorer takes a crazy amount of memory (up to around 10GB) and very high CPU usage.

Also, every time I right-click a folder and select Properties, it takes forever before the window appears. In this scenario, I've seen COM Surrogate take about 10GB of RAM and very high CPU usage.

I created a log with Windows Performance Recorder that recorded me right-clicking a folder and experiencing this issue and put it here: https://www.dropbox.com/s/qcagf3m84io7zqd/ORIGIN.08-29-2017.22-54-31.7z?dl=0

Thanks for any help anyone can give me :)

Source link: https://social.technet.microsoft.com/Forums/windowsserver/en-US/461cec4c-6cef-4b58-b265-d0c7a43f4e48/com-surrogate-amp-windows-explorer-high-cpu-and-memory-usage?forum=win10itprohardware

Answer 1

Firstly, clean boot system to exclude the influence of third-party software.

Next, run sfc /scannow to repair broken system files.

Check your disk state by some disk testing tool such as HD tune, loading issue might be related to disk.

Then, download the software "Process Monitor": https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

Start "Process Monitor": There you will find the file on which dllhost.exe attempts to get access over and over again.

When you have found your file, remove the file from your computer.

There is a video tell you how to operate.

How to fix COM Surrogate high CPU usage in Windows 10

https://www.youtube.com/watch?v=pIy7BMiEi5M

Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Answer 2

Hi There,

This might be the optimal solution for COM Surrogate's high CPU usage,

A Trojan, in this case, it's a background miner that uses 'COM Surrogate', and the reason MS Defender can't find because the file path was excluded for scanning.

Follow the instructions in this video, this might helps you

Video Link -- https://www.youtube.com/watch?v=r6HUaT7OKgY

Answer 3

i would suggest you all follow my trick
i was having com surrogate when i installed windows but after few days i started using high disk and cpu i searched every where but i found nothing
then i found one thing that all system dll are in system 32 then i opened task manager and checked the file location of dllhost and it was appdata/roaming
i scanned this file but windows didn't detected it after that i copied the the folder and pasted somewhere else and as i pasted the file the windows defender detected it and asked for actions SO THIS PROVES THAT THE FILE LOCATED AT APPDATA IS A VIRUS
RESULT: if the com surrogate is located in appdata/roaming or somewhere else then it is a virus just remove it
2. if the file is located in system 32 just copy it somewhere else and check it because defender don't scan windows files
I THINK THIS IS THE BEST WAY TO DETECT VIRUS FROM WINDOWS FILES