Solved Mail.ru re-infecting Google Secure Preferences

[Akemi]

Hi guys. Same problems as SOLVED - Google Chrome Secure Preferences Malware and SOLVED - Google Chrome Secure Preferences.

Every time I remove it, it re-infects on Chrome launch. It seems to be infected via the sync as the other user described. Attached are the FRSS log files.

 

[Akemi]

Looking over the FRSS, it's listed MaxiBuy and AnonymiserGadget in there which I've already removed. Task Scheduler lists those as "system cannot find the file". I deleted them out of the Task Scheduler.

Additionally, this is the file in question that keeps coming back on MBAM:

 

[TwinHeadedEagle]

Hello,

If you remove what MalwareBytes finds and open the Chrome again, MalwareBytes is going to find the same infection?

 

[Akemi]

Yes. It re-infects. I did a little digging myself and after I reset my sync and restarted (as well as running AdwRemoval) it seems to have cleared up. I also manually pulled out all the registry keys that were listed on the FRSS.

Seems it was hiding in the sync and resetting it did the trick.