r, f, g, h, f, l
Possible filenames are:
rgf.dll, rgl.dll, rhf.dll, rhl.dll, fgf.dll, fgl.dll, fhf.dll, fhl.dll
It displays alert messages with popups that download Total Secure 2009:

It also drops Internet Shortcut on the desktop, Favorites, Start Menu: Free Porn.url , Free MP3 Search.url, Search Online.url and VIP Casino.url
Use SmitfraudFix to remove the infection.