filestore72.info infection removing - HELP

[postcd]

Im quite lost in this malicious redirect on my vbulletin 4.2.x forum.
This redirect happens only once per day (first visit, cookie?) and only when coming from google, not direct forum visit.

The issue disappers when i disabled one plugin, then reappear next day, then again disappeared when i disabled another plugin, but then reappeared. reason?

"Disabling any mod will flush the datastore and that will appear to banish the malware temporarily. It will be back after a day or two"

OK, i examined datastore. In my /includes/config.php is:

// $config['Datastore']['class'] = 'vB_Datastore_Filecache';
Memcached is also commented out. so i asume i dont use any datastore? /includes/datastore files are almost empty, nothing important in it

But strange is that on some plugin disabling, the malicious filestore72.info redirect disappear - so there must be some cache?!(One need to use Chrome webbrowser anonymous window or similar so cache, cookies is cleared) otherwise this clever malware redirect dont happen.

Any ideas where is my datastore and how to track the infected Mod or file Please?
I can enable "vB_Datastore_Filecache" but im waiting You guys if you get any ideas on current state?

helpfullthread 1, 2