How to remove a duplicate folder virus

Updated April 17, 2017

The Duplicate, or New Folder virus is a remote access Trojan (RAT) that allows hackers to connect to your computer. Once this is done they can view your files, upload more viruses and spyware to your computer, send e-mails, delete information and totally disable your PC. The virus creates duplicate new files with icons resembling Windows folder icons--hence the name. Remove this dangerous Trojan immediately to prevent any further damage.

Press the "Ctrl," "Shift" and "Esc" keys at the same time to start Task Manager.

Click the "Processes" tab in the Task Manager window.

Select "newfolder.exe" on the list. Click "End Process" at the bottom of the window.

Repeat Step 3 for "srvidd20.exe," "iddono20.exe" and "editor.exe."

Close Task Manager.

Go to the "Start" menu, type "cmd" in the "Search programs and files" box and press "Enter" to open a command line window.

Unregister DLLs created by the duplicate folder virus. Type each of the following at the command prompt. Press "Enter" after typing each one:

regsvr32 /u shelliddono.dll regsvr32 /u libedit.dll

Type "exit" and press "Enter" to close the command line window.

Click the "Start" button and type "srv0104.ids" in the "Search programs and files" box. Press "Enter." Delete all search results.

Repeat Step 1 for the following files associated with the virus:

shelliddono.dll libedit.dll newfolder.exe srvidd20.exe iddono20.exe editor.exe

Restart your computer.


Delete and stop only the listed files and processes to avoid any damage issues with your operating system.

Cite this Article A tool to create a citation to reference this article Cite this Article

About the Author

Writing out of Los Angeles, Tim Mammadov has been a professional writer since 2010. The majority of his articles are related to computer troubleshooting and spyware protection. Mammadov graduated from the University of Maryland, majoring in finance.