About a month and a half ago I got infected by a virus called MSIL.Bladabindi. I noticed the virus quite soon because google notified me that someone from Turkey tried to access my account (I'm in Italy).
Then I looked for the access history and found out that 126.96.36.199 (which I think is a proxy, maybe related to some of my VPN?) tried to access my account, but had been blocked because it's not one of my usual location. I found out that some program exported my Chrome cookies and maybe sent them somewhere. I was using Kaspersky Internet Security, but it did not notice anything when I downloaded and installed the infected file and maybe I (stupid) granted the virus internet access through KIS Firewall. Then I ran a scan with Malwarebytes and it found the virus and deleted it. Subsequently I also used Combofix, Microsoft Malware Remover, ADWCleaner, HouseCall, Clamwin and HiJackThis just to be sure everything was ok. Later I got again to the Google access history and the suspect access log was gone along with the above-mentioned IP, but I kept it (in https://security.google.com/settings/security/activity it does not show any access log before 26th of may, but maybe they get deleted after some time. The suspect access happened on 29th of april. It says "Sign-in events unavailable prior to this date. Other activity below." (such as password change...)).
The virus created a registry key which launched it at startup and it was hidden in appdata; after Malwarebytes's scan both registry key and files in appdata were gone. But now sometimes I got a notify in Chrome asking me if I want to use google.tr instead of google.it (I don't remember if this happened also before I got infected); it's weird because the attacker location was Turkey (.tr is the turkish domain).
Today it asked me if I wanted to used google.pk .Sometimes I use a proxy (chrome extension) called Zenmate, but it does not use turkish or pakistan IPs. I did not notice any suspect activity in my PC or in my accounts (actually, when I download stuff and look at the network monitor, the download speed counter raises, but also the upload counter raises; I think it's normal, because I use NetSpeedMonitor to monitor network activity and it shows high upload speed, but when I use Windows Resource Monitor, I don't see a so high upload speed in the Net Tab).
Lastly, today I tried to exit from my Google account and got a weird message, it said somethign like: "We are sorry. Since you were connected to different Google services, we were not able to completely disconnect you. You are still connected to the services in the following domains. If you want we to continue trying to disconnect you from these domains, click on the "try again" button". So I clicked that button but I got an error message (this service is not available at this time...).
So I think someone stole my cookies and is using my account, though I changed my password after deleting the virus, but maybe the cookies aren't voided yet. How can I void them? Why does google say that I don't have contemporary accesses in my account, but when I try to disconnect it says I'm connected to different services?
Am I still infected? Is someone using my account? What can I do? What does the post-logout message mean?
Hope you will understand my twisted english and have the patience to read my long post. I am on Windows 7, Chrome 35, KIS 2014.
Thank you in advance.