a, ax, v, vi, t, tu
Possible filenames are:
avt.dll, avtu.dll, avit.dll, avitu.dll, axvt.dll, axvtu.dll, axvit.dll, axvitu.dll
It displays alert messages with popups that download WinDefender 2009:

It also drops Internet Shortcut on the desktop, Favorites, Start Menu: Cheap Pharmacy Online.url , Search Online.url, SMS Trap.url and VIP Casino.url
Use SmitfraudFix to remove the infection.