... same name used by Avira for your three samples does not imply they're binary similar/equivalent (and that's what matters when we're talking about similarity from the detection point of view) and it even does not imply that the samples were precisely analysed and put together based on the analysis results..
The trojans hosted on Rapidshare have the same name, same size, same icon, obtained from the same link and you say you that are not similar ?
Please review the trojans.
You need to improve the analysis made by automatic systems (sandbox ?).
... anyway, we would apreciate your advices (which URLs are used to collect stolen data, if you have some hints regarding this, which places on user machines are mostly occupied by the most videspread bankers etc).. 
I did not understand.