Run the registry editor regedit and search for the name of the deleted processes. Look at the startup section at the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, note and remove any suspected items, or simply rename the Run section to something else (Run1, for example). Again wait for a few minutes, if the entries reappear, or the Run section is recreated, your computer is definitely infected with scumware. The scumware needs this section in the registry, so it can start up again after the next reboot. Delete the Run entry, and do a cold shutdown. Turn power off and do not initiate the shutdown sequence, since Windows will send a shutdown message to all processes, including the scumware. If the scumware process receives the shutdown message, it will definitely reinstall itself (and you will be caught with your pants down on the next reboot).
Notice the location of the scumware (usually c:\windows\system or c:\windows\system32). Create a copy of notepad.exe and rename it to the same name of the scumware. If notepad is launched, your computer definitely has scumware. You can then notice when and how it is launched. One small advantage of renaming the scumware to notepad.exe is other portions of the scumware will fail to communicate properly with their hosts.

Continue to do a registry scan for the suspected name of the scumware. Use the Find… option (Ctrl F) for all keys, values, and data. Repeat this step with F3 if you find more than one keys having the name of the scumware. The scumware may be hidden in one of the COM interfaces in the registry, and also as a hidden file on your local hard drive, so you will need to set the folder’s setting to show all hidden and system files.

Install a personal or application firewall as soon as possible. You should note that most hardware or server-based firewall provides port protection only. The scumware can still communicate to the outside world through the firewall from your compromised computer. A personal or application firewall would help prevent further unauthorized local network access and communications, as well as unauthorized file modifications (most likely your Internet browser). Here is a freeware copy for personal, non-commercial use of the old and effective Sygate Personal Firewall (approximately 8 MBs).

Back up major applications from \Program Files. You can quickly verify if the installed program is self contained in its own directory, or it may store additional program and registration information in the registry, by running it from a different location (after copying). In many cases, the program may just ask for the registration key, and performs normally. Unfortunately, most Adobe and Microsoft software will need to be reinstalled to function properly.

Reinstall the OS using the upgrade option only, so critical system files are restored and you do not lose your current account and desktop settings.