Did the client send you a .exe? It doesn't sound like behaviour a .doc or .docx file should be able to trigger (unless it had macros built in which you would still have to approve).
Absolutely assume that your online security has already been compromised since you are seeing suspicious log-in activities, it is in your best interest to assume that your entire PC has been compromised.
1. Change your online banking information, again from a different computer! And notify your bank immediately about a possible breach. The reason for doing so is that this makes it easier to dispute potential charges to your account after the date / time of reporting, if you fail to report then they can't act.
2. If possible, disconnect the PC from the internet and run a scan on that PC from another device (through local network connection), remove any and all issues, viruses, and the likes. If you don't have another PC availble to do so, take it to a shop and explain the situation to them, whatever you do, don't reconnect until your PC has been cleaned up.
3. From a different device, change all of your passwords for frequently used sites / sites that contain your personal information. Use a different PC because there is a high probability that your current PC has been infected with a keystroke tracker.
4. Install a proper antivirus program to prevent these things from happening in future.
5. Flag the client / job to alert UpWork.
