ThreatExpert's Statistics for Rootkit.Win32.Qandr.eh [Kaspersky Lab]:

Rootkit.Win32.Qandr.eh [Kaspersky Lab] is also known as:

Threat Alias	Number of Incidents
Generic.dx [McAfee]	1
Mal/RootKit-C [Sophos]	1
Rootkit.Win32.Qandr [Ikarus]	1
Spammer:WinNT/Srizbi.A [Microsoft]	1
TROJ_SRIZBI.AB [Trend Micro]	1
Trojan.Srizbi [Symantec]	1
Trojan.Srizbi!sd6 [PC Tools]	1

Rootkit.Win32.Qandr.eh [Kaspersky Lab] is known to be created as:

%System%\drivers\csi56.sys

Note: %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).