you probably have more infections. Follow these steps.
From another PC download and install these two programs and copy the the installed folders to a USB Stick.
Restart the PC in Safe Mode and turn off System Restore and run Sophos when you have completed the 4 steps run Spybot.
Download Sophos and the latest IDE Files. Install it and extract the IDE files to the SAV32CLI folder. I normally create batch Files for the 4 runs. EG: Sav1.bat cd\SAV32CLI SAV32CLI -P=C:\SCANLOG.TXT
http://www.sophos.com/support/knowledgebase/article/13251.html
Running an information scan To run a scan for information only, so as to create a log, type the following at the command prompt: SAV32CLI -P=C:\SCANLOG.TXT This will create a log of infected files, but will not disinfect or delete any infected files. You can then copy the log to a floppy disk for printing or emailing. If you run SAV32CLI without the -P command line parameter, the information on viruses will be written only to the screen. Disinfecting infected files To disinfect infected items with SAV32CLI, use the ‘-di’ command line parameter. If a file is infected more than once (either with different viruses, or several cases of the same virus), you might need to run multiple scans to disinfect all virus infections. Do not use the command line parameter ‘-remove’ in the same scan as ‘-di’, as you could delete a file which could have been cleaned. If the infection on the computer seems to be progressing rapidly, back up your data to CD or DVD before attempting disinfection. The ‘-di’ command line parameter will disinfect infected boot sectors, some infected program (.exe) files, and infected documents (e.g. .doc, .xls). So, if your computer has been infected by a number of viruses, macro viruses, and worms, shut down the infected processes (either manually, or by using safe mode with command prompt), then run a series of scans to disinfect and remove these malicious programs. Make a log of all scans. First run SAV32CLI -DI -P=C:\SCANLOG1.TXT Make a note of the number of files disinfected. Run the scan again, with a different log name SAV32CLI -DI -P=C:\SCANLOG2.TXT If the number of files disinfected has decreased, run a third scan. If it has not, or the number is ‘0’, remove all other virus files: SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT The above scans will disinfect all files that can be disinfected, and remove the rest. During this process any infected documents will have been disinfected. Check the relevant virus analysis to find out if the virus involved could have corrupted data in the document. If you check the logs, you may well find that some worm or Trojan files were infected with a virus, so they were first disinfected, then removed.
Download Spybot – Search & Destroy 1.5.2 and install it. Update it. http://www.safer-networking.org/en/download/index.html
Run this again.
VundoFix is a freeware removal tool for many of the known variants of Trojan.Vundo, Trojan.Conhook and other similar infections.
http://vundofix.atribune.org/
I don’t dnow what antivirus that you are running but if you download and install AVG Free and then run it in Safe Mode it should tidy uo anything that is left over.
http://free.grisoft.com/doc/2/
When you think that you are clean re-enable Systen Restore.
Just to be on the safe side when you finish do an online scan with Bitdefender.
http://www.bitdefender.com/scan8/ie.html
These are the results from the last infected PC that I worked on. It also included Vundo AKA Winfixer. I also find it very interesting that when I did a Google for byvwx.exe the only reference was from Prevex. I had never heard of Prevex before Winfixer.
1 boot sector swept.
58533 files swept in 2 hours, 31 minutes and 14 seconds.
31219 viruses were discovered.
Virus ‘Troj/Dropper-EM =31191
Virus ‘Mal/Emogen-G’ =5
Virus ‘Mal/Heuri-E’ =6
Virus ‘Mal/Packer’ =2
Virus ‘Mal/Generic-A’ =2
Virus ‘Mal/ZlobJS-A’ 3
Virus ‘Troj/Agent-FXB’ =2
Virus ‘Mal/HckPk-A’=2
Virus ‘Troj/Agent-GIX’ =6