What does the COM Surrogate do and why does it always stop working?


The dllhost.exe process goes by the name COM Surrogate and the only time you're likely even to notice its existence is when it crashes and you get the message COM Surrogate has stopped working. What is this COM Surrogate and why does it keep crashing?

The COM Surrogate is a fancy name for Sacrificial process for a COM object that is run outside of the process that requested it. Explorer uses the COM Surrogate when extracting thumbnails, for example. If you go to a folder with thumbnails enabled, Explorer will fire off a COM Surrogate and use it to compute the thumbnails for the documents in the folder. It does this because Explorer has learned not to trust thumbnail extractors; they have a poor track record for stability. Explorer has decided to absorb the performance penalty in exchange for the improved reliability resulting in moving these dodgy bits of code out of the main Explorer process. When the thumbnail extractor crashes, the crash destroys the COM Surrogate process instead of Explorer.

In other words, the COM Surrogate is the I don't feel good about this code, so I'm going to ask COM to host it in another process. That way, if it crashes, it's the COM Surrogate sacrificial process that crashes instead of me process. And when it crashes, it just means that Explorer's worst fears were realized.

In practice, if you get these types of crashes when browsing folders containing video or media files, the problem is most likely a flaky codec.

Now that you know what the COM Surrogate does, you can answer this question from a customer:

I'm trying to delete a file, but I'm told that "The action can't be completed because the file is open in COM Surrogate." What is going on?

Comments (35)
  1. I found the COM surrogate invaluable for a Shell Extension I wrote. The inproc COM part of the extension shims to a .NET database COM module running under the COM surrogate and voila, the ease (laziness) of writing the database layer in .NET without injecting the .NET framework into the explorer process space!

  2. Anthony Wieser says:

    I’ve just looked up the documentation on DLL Surrogates, and it appears that the DLL must consent by setting an AppID key, as well as creating a DLLSUrrogate key.

    What you’ve said above implies that explorer does it anyway, regardless of consent.  

    Have I misunderstood this?  If not, and what you say is correct, does explorer explicitly launch the dllhost process and load the com object into it somehow?

  3. Art says:

    ok, this is probably not related, but it reminds me of something that annoys me and there’s some slim chance in heck that it could be so I’ll ask.

    In Explorer, in Windows XP, create a new folder.  Within that folder create a second folder.  Expand the folder tree in explorer’s left pane, the click on the innermost folder to display its contents (it has none in this case but that doesn’t matter for this demonstration).  Now, right click on the outer/parent folder and choose delete and choose yes at the prompt to confirm the delete.  You’ll get the little animated deleting dialog for a few seconds and then an accessed denied message.

    It’s always struck me as odd that explorer can’t delete a folder containing a folder that only it is viewing.  Just wierd, or related to surrogate use?  

    FYI – I have thumbnail caching turned off across the board and am viewing the folders in list view rather than thumbnail view.

  4. Toddsa says:

    Could it be the Explorer was using an interface running in the surrogate that was extracting a thumbnail or other resource from the file you are trying to delete and the interface was not released or is deadlocked somehow so it can not unload?

    Since I don’t know much about Explorer or what interfaces it may use to interact with files and plainly I am too lazy to do a quick search before posting, I may be way off.

  5. ton says:

    Excellent post Raymond. This post made this one from Mark that much clearer. I always wondered why dllhost.exe was involved so much when my system became so slow and unresponsive it makes much more sense now.

    http://blogs.technet.com/markrussinovich/archive/2008/09/24/3126858.aspx

  6. Dog says:

    I’m trying to delete a file, but I’m told that "The action can’t be completed because the file is open in COM Surrogate." What is going on?

    Obviously, the thumbnailer has got "stuck" and is holding the file open.

    Unfortunately, Explorer isn’t clever enough to realise that it should kill any active thumbnailers (it created them, it should be responsible for killing them if they get in the way, which they have in this case) when the user wants to do something with the file. Maybe in Windows 8…

  7. jcs says:

    This is news to me. I have Vista, and explorer.exe starts leaking memory when I browse folders that display thumbnails of .mpg files. It’s always fun to open task manager and see that explorer.exe is consuming 900MB of memory. Only when I browse my .mpg file collection.

  8. James Schend says:

    Art, I don’t get the question. If you’re viewing the folder, it’s "in use", and you can’t delete it. It would be a usability nightmare otherwise, when you could be looking at a folder on the screen that was deleted hours ago and trying to interact with it.

  9. Kyle says:

    James:

    Then just close the window.  Other Operating Systems(TM) are capable of doing that…

  10. Art says:

    James, I don’t think you fully understand.  I’m not viewing the folder in a different window, but the same explorer window, so it could clear the view.  In fact, if I try to delete the folder I’m viewing, it works, explorer does exactly that – it simply navigates navigates to the parent folder and dispalys it, or it selects none and dispalys nothing.

  11. benjamin says:

    COM Surrogates: the ‘red shirts’ in the world of Windows processes.

  12. Toddsa says:

    HAHAHA. I just got the error trying to replace a windows service that is running a COM server on my dev machine when I was trying to replace the compoment after recompiling.

  13. Boris says:

    I’m trying to delete a file, but I’m told that "The action can’t be completed because the file is open in COM Surrogate." What is going on?


    One of the few times you notice it when it hasn’t crashed?

  14. Leo Davidson says:

    Handy tip for DllHost.exe if you want to know what it is or was doing.

    The command-line will have the CLSID of the object it is hosting which you can then look up in the registry. (e.g. To find out which thumbnailer has crashed or deadlocked.)

    If the DllHost.exe instance is still running then you can use the Command Line column in Task Manager or Explorer.

    For a crashed DllHosts.exe, if you had Process Monitor running before it crashed then you can right-click one of the DllHost.exe events and get properties on the process, including its command-line.

    (Not so useful for the odd random crash as you probably don’t have ProcMon running 24/7, but if it’s a crash you can reproduce then you can ambush it, work out what’s the blame and upgrade or uninstall the codec or whatever.)

    This approach also lets you see what all those SvcHost.exe processes are doing, though they’ll have service names rather than CLSIDs in their command-line.

    It’d be cool if the OS let these generic processes set a description somewhere so that Task Manager and the crash dialogs could give more details without the legwork.

  15. reader says:

    Anthony Wieser wrote:

    > I’ve just looked up the documentation on DLL Surrogates, and it appears that the DLL must consent by setting an AppID key, as well as creating a DLLSUrrogate key.

    What you’ve said above implies that explorer does it anyway, regardless of consent.  

    Have I misunderstood this?  If not, and what you say is correct, does explorer explicitly launch the dllhost process and load the com object into it somehow?

    >

    You’re making things way too complicated.  All explorer has to do is to have its own helper COM object that runs in DLLHost, and have that helper COM object instantiate the 3rd party COM object in-proc.

  16. Will says:

    James:

    "Now, personally I much prefer a spatial file browser, but Microsoft not allowing you to close a folder that’s currently being viewed by a browser window makes perfect sense given how it’s designed."

    Microsoft does allow you to do this though.

  17. Lukas Beeler says:

    And this post just proves again that reading this blog is a very good idea even if you have no clue about programming ;)

    Thanks!

  18. Dean Harding says:

    Art: Maybe I’m not following the instructions properly, but I can do what you describe on Vista. If I delete the parent of the folder I’m currently looking in, Explorer navigates to the parent of the one I just deleted.

  19. Gaspar says:

    @Art:

    This clearly falls into the "every feature starts out at -100" rule.

    Sure it is a simple (and mostly logical) step to simply change the view and allow the delete.  That doesn’t mean it is cost effective to have someone WRITE THE CODE.  Raymond has pointed out several times that any feature that is added means that another feature did NOT get added.

  20. Anonymous Coward says:

    Re the stability of thumbnail extractors, I can confirm this. Especially the Matroska one is bad, since it keeps file handles open even if it succeeds in extracting the thumbnail. On XP that means that you have to restart Explorer to move the files, but before you do that, make sure that you select list view first, because otherwise, half the time it tries to update the thumbnails again. Of course, nowadays I just use Process Explorer to kill the file handles. Much quicker.

  21. Alexandre Grigoriev says:

    I was always wondering, what’s so difficult about using FILE_SHARE_DELETE in those file parsers? Or asking them to get their hands off the file, if Explorer is asked to delete or move the file?

    Of course, don’t expect it ever get fixed.

    Oh Wonders of Infinite Windows Wizdoms! It does things for you and you should be happy! Don’t complain that you cannot delete or move that AVI file as soon as you click on it, while Windows is doing Things Good For You for a few seconds.

    Don’t complain that Windows 7 System Recovery deleted all your files on your desktop that you had a misfortune to create after the last volume snapshot. After all, it did recover your system (even though you haven’t asked for that, thank you very much). I VERY suspect Vista does the same, though I haven’t tried to boot it with an unsigned driver (which caused the automated recovery).

  22. Christian says:

    Is this used all the time in XP? Or only in Vista?

    My w2k explorer used to crash a lot back then when it generated thumbnails…

    It would be great to learn (as in "get told" ;-)  ) more how one can launch a COM-object in a remote process.

    Obviously one can write it using a seperate process and IPC (like .net remoting as worst way), but having com do this directly by only setting a flag sounds great! Is that possible?

  23. Yuhong Bao says:

    "The inproc COM part of the extension shims to a .NET database COM module running under the COM surrogate and voila, the ease (laziness) of writing the database layer in .NET without injecting the .NET framework into the explorer process space!"

    BTW, with CLR 4.0, will managed shell extensions be supported?

  24. James Schend says:

    Kyle:

    Closing the window only makes sense if you have a spatial file browser, in which case the folder you delete *is* the same object as the window. (Which means that obviously the window should close when the folder is deleted.) This applies to GNOME, Classic MacOS, and possibly OS X if the Finder window is set to spatial mode. (But OS X’s Finder is such a weird, confused mash-up of spatial and browser concepts, who even knows.)

    Windows doesn’t use a spatial file browser, though. The window displaying the contents of the folder isn’t the same "thing" as the folder itself in Windows, and so it would make no sense to close that browser window when the folder was deleted.

    Now, personally I much prefer a spatial file browser, but Microsoft not allowing you to close a folder that’s currently being viewed by a browser window makes perfect sense given how it’s designed.

  25. mpbk says:

    Gaspar, no code needed.  Explorer already knows how to deal with deleted folders it is currently viewing.  Try viewing a deep subfolder on a network share.  Then use another window to delete a folder farther up the root.  The explorer window will just close.  Which is exactly how it should work on the local desktop.  But it only works on network shares this way.

  26. Medinoc says:

    Isn’t dllhost.exe also the "generic host" to use when you want to quickly make a DLL COM server into a out-of-process one?

  27. Kaenneth says:

    Tell me this was a change from XP to Vista, and I’ll have good reason to upgrade to Vista.

    on my XP machine, explorer frequently gets hung by codecs that I need to have installed.

  28. Ken Hagan says:

    "Isn’t dllhost.exe also the "generic host" to use when you want to quickly make a DLL COM server into a out-of-process one?"

    Yes, and that’s just what Explorer is doing. Don’t read too much into the "you" in "when you want…". Surrogacy is not just an option for the original author. It is really an option for the launching process, but with a few registry entries to make it easy for the original author to make it the default launch mode.

    Bear in mind also that you can use HKEY_CURRENT_USERClasses to override these settings per-user, and I’m pretty sure it can be done per-process too without much additional effort. (I can’t recall the exact details here.) COM is *very* flexible in how it runs components. IHMO it is Microsoft’s finest piece of code.

  29. eth0 says:

    Don’t complain that Windows 7 System Recovery deleted all your files on your desktop that you had a misfortune to create after the last volume snapshot.

    A volume snapshot.

    Sort of like a Ghost image, you mean?

    (hint)

  30. Alexander Grigoriev says:

    eth0,

    Volume snapshot is not "ghost image". It’s a frozen state of all files and directories, back in time, kept along with the current state. It’s not a copy because it doesn’t take twice as much space.

    The feature "previous versions" allows you to get such snapshot copies of files and directores. If Win7 developers had a clue, they would only restore Windows and maybe Program Files on automated system recovery. But they do it on the whole system disk.

  31. Francisco says:

    Oh i hate that it eats cpu time.

  32. 640k says:

    > COM is *very* flexible in how it runs components. IHMO it is Microsoft’s finest piece of code.

    Registryhell + dllhell? Funny.

    Most people consider this the worst part of windows OS ever created.

  33. Ken Hagan says:

    "Registryhell + dllhell? Funny.  Most people consider this the worst part of windows OS ever created."

    I don’t see the connection. Blaming COM’s designers for DLL hell is a bit like blaming GP faults on the VB6 team. Not only does the actual phenomenon pre-date the team in question, the team’s product does (if used correctly) actually make the problem much less likely in practice. (Hint: look up "interface contract" and "immutable".)

  34. me says:

    How about choosing a name that describes the process? Like

    Host Process for COM Modules

    It would also be really nice if it was easily visible what the process is doing, so people might say ‘this module is eating CPU time’ instead of ‘dllhost is eating CPU time’.

    Also, a change to a model that allows deleting open files, like all other relevant operating systems have, is rather overdue for Windows, and similarly an open mode for directories that allows unmounts, like Mac OS X has, so you can actually nicely remove USB drives while they are visible in the explorer/finder.

    [Um, Windows does support deleting open files: pass FILE_SHARE_DELETE when opening. Or are you saying, “Change to a model where programs cannot block a file’s deletion (i.e., force FILE_SHARE_DELETE on all opens)”? Imagine the bugs that would introduce… -Raymond]
  35. Alexandre Grigoriev says:

    "so you can actually nicely remove USB drives while they are visible in the explorer/finder."

    You CAN unmount a USB drive when it’s open in Explorer. But (let’s Vista bashing begins) NOT in Win2008! It always complains that the drive is in use, until you close that Explorer window, or navigate out of the drive. I suspect it’s because that window could not receive WM_DEVICECHANGE across different integrity levels.

    That was fixed in Windows 7. Not a day too soon! After only 2 years!

Comments are closed.