how to remove ctfmon.exe and win.exe

i have identified them in registry but they come back

These two files can be "good" files. Does ClamWin spot them as infected? If it does, I suggest you upload each one to Jotti at https://virusscan.jotti.org/en on the web or to VirusTotal at https://www.virustotal.com/ on thte web. Either service will give you a free scan of a file with multiple antivirus programs, including Clam. If only a couple of AVs besides Clam spot an infection, it is probably a false positive--not a real virus. If several others besides Clam do spot an infection (I like to see at least 5 AVs spot it in total), it is probably a real infection.

If you set ClamWin's infected files option to either Remove or Quarantine and then do a scan of the directory or computer, it will take care of any infected files it finds. Be sure to set the file option back to Report when you are through. If the infected files come back, there is another installation file/process that ClamWin cannot find. In that case, go into Windows Safe Mode (F8 key upon starting) and do a scan of the entire computer to remove. If that doesn't help, download Dr. Web's Cureit and Malwarebytes' Antimalware programs and do a scan with each. You can visit the ClamWin Antimalware page for their locations and to find more assistance.

If you have a false positive, tell Clam AV about it, starting at https://www.clamav.net/sendvirus/ on the web. When you get to the submission/upload page, be sure to tell them it is a false positive, give the name of the virus that ClamWin says it is, and tell them why you think it is a false positive (in your case, only a couple of other AVs on Jotti/VirusTotal spot an infection).

Regards,