markusg wrote:sorry for mistake in deleted post.
http://www.file-upload.net/download-398 ... s.reg.html
this is reg export. he was not able to find the CLSID
Sorry for delay in reply.
aptwiypzp.dll replaces ServiceDll registry path for LanmanWorkstation service (originally here should be wkssvc.dll). After restart this dll will work in address space of one of the svchost.exe processes.
aptwiypzp.dll contains strings
wkssvc.dll SysEvtC \\.\ \\.\Global\ \ntdll.dll 31st.exe
+x86 +x64 &sys=unknown &sys=windows+%d.%d
Also it has some CLSID registration data inside for something under CLSID {97A33157-2988-42BE-B4D5-93B7E823CAB8} with name "bundle". Overall it's suspicious behavior and likely this can be a part of malware. What kind of part - well without other components it's hard to say, because reconstruction of whole aptwiypzp workflow is overhead. To play with this dll all you need - put this dll to system32, change ServiceDll path for LanmanWorkstation to this dll path and do reboot.
