What Is COM Surrogate, and Why Did It Access My Location?

The location access may have come from something running inside COM Surrogate, such as a file thumbnail handler, media component, or another extension that requested location permission. That doesn’t automatically mean COM Surrogate itself is malicious. Checking the file path and running a full malware scan are good precautions, especially since the process disappeared quickly.

COM Surrogate often works in the background when Windows is creating thumbnails for images and other media. That’s why it may show up while moving or converting image files, and it can sometimes keep an external drive marked as busy. Ending the process usually lets the drive disconnect, although it’s safer to close File Explorer and wait briefly first.

COM Surrogate is normally a legitimate Windows process called dllhost.exe. Windows uses it to handle background components, such as generating File Explorer thumbnails, without making Explorer itself crash if an extension causes trouble. It can also explain why external files occasionally appear to be in use. Check it in Task Manager by right-clicking the process and selecting “Open file location.” The genuine file should be in WindowsSystem32 or WindowsSysWOW64 and should have a Microsoft digital signature. If it runs from an unusual folder, or you’re still worried, run a full scan with Microsoft Defender.