A file named swhmte82.sys in my system cannot be removed. It is located at winnt/system32/driver/. The registry entry related with it is at HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\swhmte82, the scary description is illustrated in the following two entries
Group System Bus Extender
This whole registry entry can hardly be deleted, even in the windows safe mode. I once managed to delete it, then it is automatically recovered.
It automatically generates the following entries in the registry(several similar ones not given).
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SWHMTE82 together with subentries.
qp1jnicc REG_EXPAND_SZ %systemroot%\system32\Rundll32.exe %systemroot%\system32\qp1jnicc.dll,DllUnregisterServer
swhmte82 REG_EXPAND_SZ %systemroot%\system32\Rundll32.exe %systemroot%\system32\swhmte82.dll,DllUnregisterServer
which can be deleted, but still are automatically recovered.
I checked the management tools and cannot see any service directly related either with swhmte82, or system bus.
My operation system is win2000. This is not crucial system component since the win2000 system on my friend's computer doesn't contain it, and his win xp also doesn't contain it. Google doesn't return any search results for it. Actually I have deleted both qp1jnicc.dll and swhmte82.dll and they are never recovered. One Trogan finder reported it to be a trogan. Several others I tried didn't complain about it.
Thanks for sharing lights on this issue ...
BTW, it seems similar story happens to internet explorer. When I try to delete the file, after a while it is automatically regenerated. Considering it is the notorious system binding with the operation system, I don't believe this is also the case here .... Anyway, just a technical one, doesn't anybody have any idea on deleting iexplore.exe?