ThreatExpert's Statistics for Rootkit.Win32.Agent.cmo [Ikarus]:

Rootkit.Win32.Agent.cmo [Ikarus] is also known as:

Threat Alias	Number of Incidents
Rootkit.Win32.Agent.cmo [Kaspersky Lab]	3
Troj/Pushu-Gen [Sophos]	3
Trojan.Pandex [Symantec]	3
VirTool:WinNT/Cutwail.K [Microsoft]	3
Cutwail.gen.a [McAfee]	2
TROJ_ROOTKIT.FV [Trend Micro]	2
Trojan-Downloader.Agent [PC Tools]	2
Cutwail [McAfee]	1
TROJ_PANDEX.GW [Trend Micro]	1

Rootkit.Win32.Agent.cmo [Ikarus] is known to be created as:

%System%\drivers\gsy85.sys

%System%\drivers\lyi33.sys

Note: %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).