Do the Internet and yourself a favor, disconnect your LAN NOW. This prevents many things that will make your job harder:
- disconnects your botnet slaves from their controllers
- malware loaders phoning home (so to speak) for more trojans to download
- spam forwarding
- limits infection vectors (finding more targets to go after)
- prevents further uploads of your confidential information
Shut down all infected or suspect computers, as in, power them off.
Start with, or make a known good machine, either by re-installing it or unpacking it. Harden it. Make another if you have someone working with you, so you each have one to work from. Attach them to the Internet or the LAN, but never both (for now). Now you have a computer to work from.
Start with all your managed network equipment, routers, switches, firewalls and gateways. Make sure there are no hacks installed. Harden them. Now you have a LAN you can work on.
Disinfect suspect computers agressively. The preferrable method is re-imaging. If you are not prepared for this, re-install and restore backups. If you are not prepared for this, try pulling the hard drives and attaching them via USB adapter to the known good machine(s). The key point is, it is difficult to disinfect a computer while malware is live. If you are working with a bootable disk in a non-bootable format, there is no live malware fighting your efforts.
Once you get to volume disinfecting/reinstallation, call in help. Temps, shipping/receiving clerks, admin assistances, interns, power users, if you tell management it will cut time they'll find someone to help you. Just having someone grab computers and put them all in a row will save you time to focus on the hard stuff.