Boot in safe mode.
Switch System Restore off.
Press ctrl/alt/del and in Taskmanager try to STOP:
mcrt32.exe
lsass2k.exe
MDNZ.exe
smtp32.exe
p6.exe
wuacti.exe
mssupdate.exe
Next, run HJT on its own and let it 'fix' if still there:
C:\WINDOWS\System32\mcrt32.exe
C:\WINDOWS\System32\lsass2k.exe
C:\WINDOWS\System32\MDNZ.exe
C:\WINDOWS\System32\smtp32.exe
C:\WINDOWS\System32\p6.exe
O4 - HKLM\..\Run: [Start Upping] mcrt32.exe
O4 - HKLM\..\Run: [lsass2k Update] lsass2k.exe
O4 - HKLM\..\Run: [MDN] MDNZ.exe
O4 - HKLM\..\Run: [SMTP32 Mailing Protocol] smtp32.exe
O4 - HKLM\..\RunServices: [Start Upping] mcrt32.exe
O4 - HKLM\..\RunServices: [lsass2k Update] lsass2k.exe
O4 - HKLM\..\RunServices: [MDN] MDNZ.exe
O4 - HKLM\..\RunServices: [SMTP32 Mailing Protocol] smtp32.exe
O4 - HKCU\..\Run: [Windows Auto Update] wuacti.exe (do a search for it)
O4 - HKCU\..\Run: [MDN] MDNZ.exe
O4 - HKCU\..\Run: [Start Upping] mcrt32.exe
O4 - HKCU\..\Run: [SMTP32 Mailing Protocol] smtp32.exe
O4 - HKCU\..\Run: [lsass2k Update] lsass2k.exe
O4 - HKCU\..\RunServices: [Start Uppings] mssupdate.exe (do a search for it)
Unless the IP-numbers are from your ISP, also fix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{F55AC4C9-8A2B-4EB2-884F-432BF6A4D66A}: NameServer = 80.225.253.50 80.225.253.58
When done, delete the bold files.
Boot normal. If all OK, put System Restore back on.