help me remove virus please

hi i recently got some1 hacked into my pc and using keylog to take my game passwords so i scanned my pc and this is wat i find

Trojan.PWSteal.Lineage (PWS-Lineage [McAfee]
PWSteal.Lineage [Symantec]
Troj/Lineage [Sophos]
Trojan-PSW.Win32.Lineage [Kaspersky]
W32/PSW.Lineage [NOD32v2])

Type: Trojan

Threat Level: High

Description: Trojan.PWSteal.Lineage is a group of password stealing Trojans that attempt to steal passwords associated with the game called "Lineage" or "Lineage II", and send it to the creator of the Trojan.



Trojan.QQHook.A (Troj/QQHook-A [Sophos]
Trojan-PSW.Win32.Delf.ic [Kaspersky]
Trojan-PSW.Win32.Delf.oc [Kaspersky])

Threat Level: High

Description: Trojan.QQHook.A is a Trojan that attempts to steal information from the infected machine

and 1 of my mate tells me to use Filemon to check and he find out that the virus is in my svhost32.exe and systam32.exe, can any1 help me to remove them step by step please, im not really good at IT

 

View attachment Activescan.txt

View attachment bdscan.txt

View attachment hijack scan.txt

 

I still need the other logs.

Shownew and RUnkeys.

 

View attachment runkeys.txt

View attachment show new.txt

 

Does he mean that a module is injected into these processs ? How did he tell that using filemon? do you mean process explorer also by sysinternals ?

Using add/remove programs which can be accessed from the control panel, uninstall the following:

Download

- Pocket KillBox

Extract to its own folder somewhere that you will be able to locate later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Make sure you have rebooted in Normal Mode (do not open any other processes)



Run HijackThis. Click the 'Do a system scan only' button.


Once the scan has completed click Config

Click Misc Tools

Click Open Process Manager

Terminate the following processes by selecting them from the list and clicking Kill Process
Note: These may not be running but we need to check/

close HijackThis.

Now run Pocket Killbox:

Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Let me know if you have any problems deleting these files!

If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.


REBOOT to Normal Mode.

Let me know how things are running now

Post a fresh HijackThis log, a fresh newfiles log and a fresh activescan log.