trj/ci.a generic malware part 3

Sorry guys i said in my first post it was ie8 and infact its ie9. I have located 1 of the problem files which is in c:\windows\sys32\config\sysprofile its called mwfmfysqygfgoseh.exe this appears to create further files in the same folder with different names but all along the line of 4b06.tmp. Each time one of these is created it opens internet explorer on msn home page (my homepage is set to google). when i scan folder with my anti virus it deals with these files and everything works fine as long as i dont reboot (which my anti virus program tells me too). When i do reboot it starts all over again.