My account is being used

[AAxeL08]

Hello all, I will get strait to the point, my account has been used as SC farm for more than 6 months using Archi's SC Farm and I would love to know how to remove what ever worm or bug that has been implanted into my steam client/steam account. For some background, I have never used this tool and had no idea this existed until I noticed my account was a part of this group. I personally do not know how this tool works, but I can tell you I take the security of my information very seriously and I cant see any way my account could have been compromised. Any help would be greatly appreciated. Thanks!

[.PS1d3Я]

Your account will only be used by ASF when you have the program open. As to joining the group, it's a default option which can be changed in settings. You can leave the group, but you need to turn that setting off so it won't join again.
If you don't know how to do this, go to the group's main page (overview) and follow the link to the wiki, where it has all the info you need.
If this is what you mean by your account being compromised, then relax, it's just a matter of changing a setting.
If it's something else, then either you downloaded ASF from a non official source and it might contain some Trojan/worm, or you have some other problem that has nothing to do with ASF.
Edit: After reading again, you say you never downloaded or used ASF? If that«s the case then someone else has your login details, but i don't see how that could happen as they would need access to your authenticator.

[Rudokhvist]

If your account is used in ASF it means either you are using ASF or someone using ASF with your credentials. No other option. If you don't use ASF but your account still used in ASF - it means your account credentials were compromised, no other option. In this case you should change your password, "Deauthorize all devices" on steam guard page, and revoke your API-key. And next time take security of your account more serious, because clearly you leaked your credentials somehow. And I really recommend to start using two-factor authorization in this case.

[AAxeL08]

Hello, I too am very confused as I always have used 2FA for my steam account and my password is a poem that no one else but me knows about (because I wrote the poem). This means the attacker could not have used my credentials (unless they were brute forcing it for years) and might have found a exploit or bug in the steam API itself. Thank you for your time and I will take the advice given.

edit: I would also like to note that I never received an email from steam saying that somebody had logged into my account, but I know my account has been used as a SC Farm because I constantly have emails about SCs being traided and sold, a lot of them from games I own but have never played.

edit 2: note that I never had money from the selling of the SCs transfered into my account or debit/credit card as the money from the sale was immediately used to purchase a new SC.

[Rudokhvist]

No, it's definitely not an exploit or bug of the steam API itself. Because if it were the case - you would be literally last in the list with such an account. Why not steal my inventory instead, it worth about $500+? And I'm not the richest man in steam, very far from it - why not steal their accounts? It's clearly a compromised account. Most probably you yourself entered your one-of-the kind password on some phishing site, and also entered your 2fa code after that. That's much more probable than some hacker who found 0-day exploit in steam, but decided to steal from poorest guy and didn't even bother to hide it's activity. That's not impossible, but sounds not realistic.

[Archi]

As Ryzhe said above. If anything, this group was actually able to tell you that somebody has compromised your details - most likely you entered them yourself on some phishing site as stated above, once one of your friends asked you to "vote for their team" or likewise crap.

Of course if you believe against everything we've written you're free to contact with Steam support and they can investigate and help you further, but the most likely case is that either you yourself used our program and already forgot about it, or somebody else did using your credentials.