Log HijackThis [finalizado]

Pessoal.. Aqui no meu computador está muito estranho...

Não consigo ver os objetos ocultos do computador, não consigo instalar Avast...Pendrive não formata... E todo computador que coloco o Pendrive fica na mesma situação.

Queria que desse uma olhada no log e no Autorun do Pendrive que não deixa formatar.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:17, on 4/1/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
C:\Arquivos de programas\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe
C:\Arquivos de programas\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZyDummyZD11B-BG.exe
C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe
C:\Arquivos de programas\Ares\Ares.exe
C:\DOCUME~1\IORISI~1\CONFIG~1\Temp\winpdpxv.exe
C:\DOCUME~1\IORISI~1\CONFIG~1\Temp\winfxmmk.exe
C:\DOCUME~1\IORISI~1\CONFIG~1\Temp\winnuspe.exe
C:\Arquivos de programas\Winamp\winamp.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\Arquivos de programas\MSN Messenger\usnsvc.exe
D:\2u.com
D:\2u.com
C:\Arquivos de programas\Unlocker\UnlockerAssistant.exe
C:\Arquivos de programas\WinRAR\WinRAR.exe
C:\DOCUME~1\IORISI~1\CONFIG~1\Temp\Rar$EX00.750\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R3 - URLSearchHook: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Barra de Ferramentas do Yahoo! - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Arquivos de programas\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe
O4 - HKLM\..\Run: [@RegRunOnSecure] C:\ARQUIV~1\Greatis\REGRUN~1\OnSecure.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Arquivos de programas\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [ares] "C:\Arquivos de programas\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Regrun2] C:\ARQUIV~1\Greatis\REGRUN~1\WatchDog.exe
O4 - HKCU\..\Run: [Registry] "C:\Arquivos de programas\Greatis\RegRunSuite\lsoon.exe" -1 30 "C:\Arquivos de programas\Greatis\RegRunSuite\rescue.exe" /a "c:\backreg\rstore.ini"
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\kamsoft.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} (JInitiator 1.3.1.22) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{A1D0530E-B4BC-4C9C-81E9-44776D7A9055}: NameServer = 189.56.100.74
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: ZyDAS1211BBG - Unknown owner - C:\Arquivos de programas\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\srvany.exe
--
End of file - 4780 bytes




Autorun do Pendrive está assim:
;asds00fCkoaKalqK3sA03K9is5qwAa4aZ0k4sn2erwdAa2e1iaKr1S5lasiKcAso0IlL4aDwLoSlD5Dk2aAk54w5rd741lDw8i
[AutoRun]
;jw2dasapLkd3dK6l95SaKZilSqsUf7s7l4flsK3
open=2u.com
;DJDLalDdwaKfi13dessZ27Ki42a5kawXLLidK7e3oeqirAsw5k2A13or8jfDAmL0l0jk0a2iS4wDsDK023sfiaksLicAClLL1dkqaaOw0Lqf3alf3k4a3Z4ao
shell\open\Command=2u.com
;CDwoaae5kK2D7lA0La39saD1il2afDspl4sLq07AsD4Olji9aji4Hdawfok3K3keiqf4rj28k2i1rA5iqi304dwALLo353DJ
shell\open\Default=1
;kawD423a7wjsL4o558aSK
shell\explore\Command=2u.com
;Aor38A4DqK3L4rq44ZwrFed9KasKAkDs3DoOkKk244w0Kd4koKriqlJXiLaLLsJ2kaq5awia3d29lwjCajlc0nkiL4l3aiK2a82




Esse arquivo 2u.com deve ser vírus, não consigo removê-lo de nenhum jeito.

Grato desde já!