ThreatExpert's Statistics for SpywareProtect2009 [Symantec]:

SpywareProtect2009 [Symantec] is also known as:

Threat Alias	Number of Incidents
not-a-virus:FraudTool.Win32.WinSpywareProtect.eo [Kaspersky Lab]	702
Troj/FakeAV-KM [Sophos]	702
PWCrack-Winspy [McAfee]	676
Virus.Win32.AdWare [Ikarus]	624
RogueAntiSpyware.WinSpywareProtect [PC Tools]	52
FakeAlert-C.dr [McAfee]	36
Troj/FakeAle-MC [Sophos]	36
RogueAntiSpyware.Sysguard [PC Tools]	32
Trojan:Win32/FakeSpypro [Microsoft]	26
Trojan.Win32.FraudPack [Ikarus]	22
Trojan.Win32.FraudPack.ase [Kaspersky Lab]	18
Troj/FakeSp-Gen [Sophos]	14
Trojan.Win32.FakeSpypro [Ikarus]	13
Trojan:Win32/Tibs.IT [Microsoft]	11
Mal/Generic-A [Sophos]	10
Generic.dx [McAfee]	9
Win-Trojan/Bho.12032 [AhnLab]	9
Trojan.Win32.FraudPack.kho [Kaspersky Lab]	8
Trojan.Win32.Tibs [Ikarus]	8
FakeAlert-DH [McAfee]	7
Trojan.Win32.BHO.whc [Kaspersky Lab]	7
Troj/SWProt-Gen [Sophos]	6
FakeAlert-FV.dll [McAfee]	5
not-a-virus:FraudTool.Win32.WinSpywareProtect.vw [Kaspersky Lab]	5
RogueAntiSpyware.SpywareProtect2009 [PC Tools]	5
Troj/Dloadr-CIE [Sophos]	5
Trojan.Win32.Zbot [Ikarus]	5
Win-Trojan/Agent.10752.RU [AhnLab]	5
BackDoor-AWQ.b [McAfee]	4
not-a-virus:FraudTool.Win32.WinSpywareProtect.dx [Kaspersky Lab]	4
Troj/FakeAV-LS [Sophos]	4
Trojan.FraudPack!sd6 [PC Tools]	4
Trojan-Dropper [Ikarus]	4
Win-Trojan/FakeAlert.9728.C [AhnLab]	4
Win-Trojan/Riggin.272896 [AhnLab]	4
Backdoor.Win32.Hupigon.gifl [Kaspersky Lab]	3
Backdoor:Win32/Bifrose.EY [Microsoft]	3
Mal/EncPk-GT, Mal/Behav-103, Mal/Behav-043 [Sophos]	3
Packed.Win32.Krap [Ikarus]	3
Packed.Win32.Krap.c [Kaspersky Lab]	3
Trojan-Dropper.Agent [Ikarus]	3
Trojan-Dropper.Win32.Agent.avgt [Kaspersky Lab]	3
Trojan-Dropper.Win32.Agent.bals [Kaspersky Lab]	3
Adware-BHO.gen.f [McAfee]	2
Downloader-BPX [McAfee]	2
FakeAlert-CL [McAfee]	2
FakeAlert-SpyPro.gen.dll [McAfee]	2
Generic PUP.x [McAfee]	2
Generic.dx!ds [McAfee]	2
not-a-virus:FraudTool.Win32.WinSpywareProtect [Ikarus]	2
Troj/Bdoor-ARX [Sophos]	2
Troj/FakeAV-VI [Sophos]	2
Trojan.Win32.BHO [Ikarus]	2
Trojan:Win32/Riggin.A [Microsoft]	2
Win-Trojan/Xema.variant [AhnLab]	2
Win-Trojan/Zbot.308752 [AhnLab]	2
Backdoor.Win32.Hupigon.fxye [Kaspersky Lab]	1
Backdoor.Win32.Hupigon.fykj [Kaspersky Lab]	1
Backdoor.Win32.Hupigon.fyll [Kaspersky Lab]	1
Backdoor.Win32.Hupigon.fytz [Kaspersky Lab]	1
Backdoor.Win32.Hupigon.fyub [Kaspersky Lab]	1
Backdoor.Win32.Hupigon.gakx [Kaspersky Lab]	1
Backdoor:Win32/Lamin.A [Microsoft]	1
Dropper/Malware.54272.F [AhnLab]	1
FakeAlert-B [McAfee]	1
FakeAlert-FF [McAfee]	1
FakeAlert-SpywareProtect [McAfee]	1
Gen.Trojan [Ikarus]	1
Generic BackDoor [McAfee]	1
Generic Downloader.x [McAfee]	1
Generic FakeAlert!du [McAfee]	1
Generic FakeAlert.a [McAfee]	1
Generic PWS.y [McAfee]	1
Generic PWS.y!cn [McAfee]	1
Mal/Behav-004 [Sophos]	1
Mal/EncPk-FO [Sophos]	1
Mal/EncPk-FO, Mal/FakeVirPk-A [Sophos]	1
Mal/FakeAV-BR, Mal/FakeAV-BT [Sophos]	1
Mal/FakeAV-CF [Sophos]	1
Mal/UnkPack-Fam [Sophos]	1
not-a-virus:FraudTool.Win32.SpywareProtect2009.f [Kaspersky Lab]	1
not-a-virus:FraudTool.Win32.WinSpywareProtect.ej [Kaspersky Lab]	1
not-a-virus:FraudTool.Win32.WinSpywareProtect.qe [Kaspersky Lab]	1
not-a-virus:FraudTool.Win32.WinSpywareProtect.qu [Kaspersky Lab]	1
not-a-virus:FraudTool.Win32.WinSpywareProtect.rs [Kaspersky Lab]	1
not-a-virus:FraudTool.Win32.WinSpywareProtect.se [Kaspersky Lab]	1
not-a-virus:FraudTool.Win32.WinSpywareProtect.wn [Kaspersky Lab]	1
RogueAntiSpyware.AntivirusSystemPro [PC Tools]	1
Troj/BHO-MA [Sophos]	1
Troj/FakeAle-NM [Sophos]	1
Troj/FakeAl-I [Sophos]	1
Troj/FakeAV-QN [Sophos]	1
Troj/FakeAV-TM [Sophos]	1
Troj/FakeAv-UY [Sophos]	1
Troj/FakeAV-VS [Sophos]	1
Troj/FakeVir-KA [Sophos]	1
Trojan.Win32.BHO.vcc [Kaspersky Lab]	1
Trojan.Win32.FraudPack.akfg [Kaspersky Lab]	1
Trojan.Win32.FraudPack.owm [Kaspersky Lab]	1
Trojan:Win32/Meredrop [Microsoft]	1

SpywareProtect2009 [Symantec] has the following possible country of origin:

Origin		Number of Incidents
	Russian Federation	4

SpywareProtect2009 [Symantec] is known to be created as:

%AppData%\eehl\eehl.exe

%AppData%\ievyco\kgjwsysguard.exe

%AppData%\jndqqy\wanpsysguard.exe

%AppData%\lbvper\vtmksysguard.exe

%AppData%\wokjje\pkbcsysguard.exe

%ProgramFiles%\fkvuyv\qyflsysguard.exe

%ProgramFiles%\microsoft office\office11\smss.exe

%ProgramFiles%\msn\msn.exe

%System%\bifrost\server.exe

%System%\iehelper.dll

%System%\msn\msn.exe

%System%\winupdate.exe

%Temp%\office11\smss.exe

%Windir%\sysguard.exe

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.