Mycheckfree victim!!

I was one of the people who logged onto Mycheckfree during the 5 hours they were hacked. The site only had a blank page on Firefox, so I used I.E. to try the site and my Avast! free showed trojan warnings. I waited until the next day and Mycheckfree worked fine. Last week I got two emails from a billing place and an adult DVD site saying I had signed up and they had a username and password I have used for years for a few sites. They didn't have my credit card info (some other #) and didn't use my name (some guy from Washington)
Then I get this alert from Mycheckfree that detailed the hacking and offered free Macafee antivirus and 2 years of Identity Theft protection for free.

I guess the Trojan involved in the hack is the new Gozi virus with the keylogger and it can get info from SSL streams. I've run Avast! and Spybot search and destroy and found a couple keygenerator viruses, but not the Gozi.

Does anyone know a lot about this new Gozi Virus and what to use to detect it and remove it?? Secureworks Says:

"Containment

Because of the rootkit capabilities that the trojan uses to hide these values and its own files, booting into Safe Mode is required.

Having validated observed behavior with static analysis, one knows the trojan sets up everything it needs according to its environment each time it's run:

* Checking for an existing infection
* The calculations of port numbers, ID, new options (if needed)
* LSP for network data sniffing/forwarding
* The registry keys and files for reboot persistence

All the information the trojan needs to do this is its own code (the file) and the values written to three registry keys:

* HKLM\SOFTWARE\Microsoft\CurrentVersion\xx_id
* HKLM\SOFTWARE\Microsoft\CurrentVersion\xx_options
* HKLM\SOFTWARE\Microsoft\CurrentVersion\Run\xx_Shell

To start cleaning the trojan, make note of the xx_Shell key's value and delete these keys.

The copy of the trojan code is the file named like xx_????.exe (where ???? is four random lowercase letters) in the user profile directory pointed to by the xx_Shell registry value, as noted above.

Additionally, to erase all evidence of the trojan, one would want to remove any other files named like xx_????.exe and xx_tempopt.bin from ALL user profile directories and delete the registry key HKLM\SOFTWARE\Microsoft\CurrentVersion\xx_version as well.

Another reboot to exit Safe Mode, and the machine is free of the original trojan code.

Note that because this trojan includes the capability to download and execute arbitrary code from untrusted sources, a complete rebuild of the infected PC is the only absolute way to ensure 100% confidence and trust in data and system integrity. "

How do I find out for sure if I have this and what do I do now? I do all my banking, bill paying, shopping etc.. online via Firefox..they say I.E. is what is vulnerable...

HELP!!

Thanks!

 

Here is the log....sorry!

 

Will a moderator be able to help me with this? Is there a program that will detect this new Gozi virus? I'm terrified about my financial info. I've called my bank, but I want to know my computer is ok, Please??? Anyone??

 

Ok. Here are my logs. Question...are these combo of programs SURE to find this new strain of the GOZI virus that keylogs and gets info from SSL? Thanks!

 

Here is MGLogs.

 

Thanks so much. The thing that gets me is, the username/password that was used for this DVD subscription was NOT the username/password I use to log in to Mycheckfree..that's why I think the keylogger was on there. The thing Avast caught were keygenerators, not keyloggers. The Secureworks site says this trojan can hide, destroy and regenerate the files it needs to operate according to the startup conditions on each startup. That's why I wonder if it could hide itself from all of these programs you had me use.
I did call my bank and had privacy protection put on which protects me from any loss due to identity theft and also monitoring my credit reports. Only one credit card had the compromised username/password and my cards are maxed out anyway, so the crooks wouldn't like me, lol.

Thanks so much for all your help. For peace of mind, I may just do a backup and then reinstall windows, although I don't know if that would even completely wipe the virus off the hard drives... I have a three drive RAID system...not too sure how to reconfigure RAID drives to wipe things out anyway....man, what a pain..

Thanks again.