Wireshark installed to monitor outgoing email traffic

Uh oh...

According to this document, section 5.1, Torpig communicates via HTTP POST requests that are pretty cryptic - meaning, that there is no human readable part in the post request, just HEX patterns.

In your case I'd filter out all packets that do POST request, like this: http.request.method==POST (put that into the filter entry bar just on top of the packet list, after loading one of your trace files). Then, do a comparision by eye to see if you can detect those cryptic patterns (the human eye is pretty good at this, so just scroll through the filtered packets).

If you see any, your provider was probably right. Then you need to determine which station it is on your network and take it down, backup all vital data, and reinstall it. Most forensic experts do not advise to try and clean the infected system unless you're a forensic expert yourself, because it is pretty hard to tell if you "got it all". Instead, do the reinstall and start with a clean slate.