sup, sys, roi, safe, sf, s
Possible filenames are:
supsafe.dll, supsf.dll, sups.dll, syssafe.dll, syssf.dll, syss.dll, roisafe.dll, roisf.dll, rois.dll
It displays alert messages with popups that download Total Secure 2009:

Use SmitfraudFix to remove the infection.