Neither of those, have not typed my password anywhere other than in the osbot client. have downloaded nothing other than osbot since i downloaded it. have been to no websites other than youtube and facebook.
also assuming i got ddosed as internet dced and when i went to log back in, someone was on my account, so means that person would have needed to get my ip, which also points towards osbot.
not meaning to be a dick about it, but it does seem suspicious......