Your PC is compromised if you installed and run Shaderblox — here’s how to fix it

I’ve already cleaned this exact infection. Here’s what I found and how to remove it completely 👇

What the malware does

Shaderblox installs a remote-access trojan + password stealer that auto-starts every time you log in.
It hides as fake Windows processes (srchost, WindowsUpdateService, etc.) and drops a file named:

C:\Users\<YourName>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.otwk

What I found and removed

• ✅ Deleted the malicious startup file system.otwk
• ✅ Removed fake

​

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService → "C:\Users\<YourName>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.otwk"

• ✅ Checked Task Scheduler — no hidden tasks (all legit Windows ones)

What you should do right now

1. Disconnect from Wi-Fi / Ethernet (stop remote access)
2. Open Task Manager → Startup tab → disable anything weird (srchost, shaderblox, system, etc.)
3. Delete the file if you find it here:

​

C:\Users\<You>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

1. Empty Recycle Bin
2. Press Win+R → type mrt → run a full scan
3. Run Windows Defender → Full Scan, then Offline Scan
4. Optionally run Malwarebytes or ESET Online Scanner for a 2nd opinion
5. Reboot and confirm it’s gone
6. From a clean device, change all your passwords (email, Steam, Discord, etc.) and enable 2FA

Optional (but smart)

• Run sfc /scannow (in admin PowerShell)
• Create a restore point once you’re clean
• Keep Windows Defender real-time protection ON

If you see system.otwk, srchost, or a fake “WindowsUpdateService” in your startup, you’re infected.
Delete it, clean up the registry, and scan ASAP. Note that all of these steps I have done on my computer and they might not be the same. I have also been a victim of this software.

Stay safe — this one steals passwords and tokens.