Warning: ISESteroids Update is malicious

[u/dwj7738]

When I launched ISESteroids (Start-Steroids) I clicked update. Chrome notified me that the website was not-safe dummy here found the run website anyway and the Avast nightmare began ... 5 popup windows that my computer had 5 virus's , anti-virus not installed, blah blah blah .. Shutdown chrome, cleared my cookies, %temp% directory.. these popups just kept reappearing if I closed one.

reboot doesn't fix anything.. nothing in task manager helps narrow down what's launching even with chrome closed... sysinternals autoruns no help. real help.

While I built a new Veeam Agent install usb to potentially restore from yesterday (3 hour process) I started poking around in chrome and in the extensions I found something I didn't recognize and deleted it.. rebooted the computer and now its back to normal without restoring from backup.

[u/invalidconfiguration]

Check the notification setting in your browser, see if a new site was granted permission. I have seen it happen where a user grants access accidentally and then gets spammed notifications for viruses etc. through Windows notifications.

[u/Bilson00]

These malware tend to dump secrets; I’d strongly consider rolling creds and keys you have locally that may be compromised now (in scripts, config files, environment variables, etc)

[u/BlackV]

That seems interesting, you talked to the ISE steroids team ?

It's licensed these days right?

[u/Subject_Meal_2683 → u/BlackV]

Their site seems to be taken by a domain scam site. And for some weird reason the PS module got an update 3 months ago while the update before that was 7 years ago.

So there is a chance this module got compromised.

Edit: see the response to my post where someone had contact with the author of the module, the module is NOT compromised!!!

[u/surfingoldelephant → u/Subject_Meal_2683]

I spoke with the author (FWIW, Tobias is well known and a member of the official PowerShell workgroup). He confirmed version 2.8.0.0 from 3 months ago is legit. Just don't click on any links to powertheshell[.]com.

All 2.8.0.0 did was add a free license so that ISESteroids is available to everyone free of charge. I compared the files/hashes in the latest with the previous version and they're identical, aside from the added universal.license, bumped version and a few renamed text files. I also double-checked the ISESteroids.dll binary is still signed with a valid certificate.

Per Tobias, here's why OP ran into some issues (cc u/dwj7738):

The issue is that (a) the binary version did not change, yet I needed to bump up the gallery version to be able to upload the free license, but the side effect is that now isesteroids is reminding you to „update“ to the new version forever. Solution: turn off automatic update check in menu „Help“. (b) I gave up the domain powertheshell[.]com years ago, and had naively assumed the links in the software (i.e. to purchase a license) would simply fail. However, someone acquired the domain and is deliberately using my old links for fishy advertising. (c) if you have installed a personal license, it takes precedence over the new free community license. You see the new license only when you either never applied a license, or removed your existing license.

He also explained why the issues still persist:

Isesteroids development was frozen in 2016, and I have no access anymore to the build environment, nor do I still have the required digital code signing certs. Same for the powershell.one website. Essentially same fate that Windows PowerShell experienced when PowerShell 7 surfaced: use as-is basically.

So it's safe to use ISESteroids providing you:

• Get version 2.8.0.0 from the gallery.
• Disable automatic updates/avoid update checks.
• Avoid any links to powertheshell[.]com.
• Use the legit docs at: https://powershell.one/isesteroids/quickstart/overview

[u/dwj7738 → u/surfingoldelephant]

Thank you for the update.. I didn't know about this 'universal license' or why clicking a link from a trusted publisher would cause issues.

[u/surfingoldelephant → u/dwj7738]

You're welcome.

It doesn't look like the author can do anything about the in-app update check, but they might at least be able to fix the info links in the gallery page.

[u/Subject_Meal_2683 → u/surfingoldelephant]

Thanks for the update, this explains the version bump after so many years.

[u/BlackV → u/surfingoldelephant]

Thanks the the efforts

[u/purplemonkeymad → u/surfingoldelephant]

Avoid any links to powertheshell[.]com.

Sound like setting it in your hosts file to be localhost might be a good idea. Or just outright blocking dns/filtering at your edge if you can.

[u/surfingoldelephant → u/purplemonkeymad]

Yeah, good idea.

[u/BlackV → u/Subject_Meal_2683]

Ah boo, that's sad, they had a long PowerShell history, to end like this :(

Edit: although reading the OP, looks like maybe OP had a compromised system or just the update site

[u/dwj7738 → u/BlackV]

Yes licensed

[u/surfingoldelephant → u/BlackV]

It's free to use now. See my other comment here.

[u/BertMacklenF8I]

Where were you digging and can you elaborate on this chrome extension?

[u/ReneGaden334]

Good to know. I didn’t use my license for quite some time, but I really did like the UI more than VSCode.
They never went past PowerShell 5, did they?

[u/dwj7738 → u/ReneGaden334]

ISE never went pas PowerShell 5.2

[u/BlackV → u/ReneGaden334]

its was tied to ISE last time I used it, so likely no