MD5: 0b0052db093c79d56d6c283c89902c09
SHA1: 667d74c172c5e199b11f752ae29bc8f7720800b1
SHA256: 1e01f8e2f0b0bb5a249222c6e740d5bc8a3116f326d79cc368492e38f5cdac4d
SSDeep: 98304:8Ihyxuuo1S8CspNqs1iexQP447kIh1nsYCnGdpPPvbBEh1:8IcS1SW5hx6P7/h1nsYFjBK1
Size: 4296912 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2006-04-07 20:59:26
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

RediffMessenger.exe:1880
%original file name%.exe:2304

The Malware injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process RediffMessenger.exe:1880 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 (1168 bytes)
C:\Windows\System32\config\SYSTEM (1336 bytes)
C:\Boot\BCD.LOG (1768 bytes)
C:\Windows\System32\config\SOFTWARE (69394 bytes)
C:\Windows\System32\config\DEFAULT.LOG1 (5208 bytes)
C:\Windows\System32\config\SECURITY.LOG1 (1048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\UsrClass.dat (5640 bytes)
C:\Windows\System32\config\DEFAULT (5328 bytes)
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT (1592 bytes)
C:\System Volume Information\Syscache.hve (16624 bytes)
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 (1168 bytes)
C:\Users\"%CurrentUserName%"\NTUSER.DAT (20464 bytes)
C:\System Volume Information\Syscache.hve.LOG1 (9576 bytes)
C:\Windows\System32\config\SYSTEM.LOG1 (1779 bytes)
C:\Windows\System32\config\SECURITY (1120 bytes)
C:\Users\"%CurrentUserName%"\ntuser.dat.LOG1 (18688 bytes)
C:\$Directory (880 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (74546 bytes)
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 (4768 bytes)
C:\Boot\BCD (2080 bytes)

The process %original file name%.exe:2304 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\Rediff Bol\redifftoolbar.xpi (4992 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\laugh_static.gif (282 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Regular.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_ln.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Disabled.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Regular.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\smile.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\confused_static.gif (257 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Hover.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\devil.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Hover.png (1 bytes)
%Program Files% (x86)\Rediff Bol\RediffToolbar.exe (21246 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Regular.png (991 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\bol.in.bollywood_ishtyle.xml (854 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\Alert.wav (8 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\chimedwn.wav (5 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\SmileyCodes.txt (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\StatusAlert.png (738 bytes)
%Program Files% (x86)\Rediff Bol\RDTelConv.dll (3722 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\ioSpecial.ini (9733 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\QuillWebLoading.html (173 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\brokenheart_static.gif (301 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sarcastic_static.gif (250 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Hover.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\grey.swf (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh934.tmp (290478 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\RINGIN.WAV (784 bytes)
%Program Files% (x86)\Rediff Bol\Qt-VC71-MT.dll (135026 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\wink.gif (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Rediff Bol 8.0 Messenger.lnk (908 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\MessageAlert.wav (1856 bytes)
C:\Windows\Fonts\Shree502.ttf (1856 bytes)
%Program Files% (x86)\Rediff Bol\uninstall.exe (2163 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Click.png (627 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\tongueout.gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp (4 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\embarrassed_static.gif (240 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\brokenheart.gif (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rediff Bol\Uninstall.lnk (1 bytes)
%Program Files% (x86)\Rediff Bol\RDHinConv.dll (3398 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\bol.in.c_ya.xml (226 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Disabled.png (545 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\devil_static.gif (245 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\RINGOUT.WAV (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\Flash[1].ocx (102659 bytes)
%Program Files% (x86)\Rediff Bol\RDMalConv.dll (2461 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\urls.xml (2 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Regular.png (776 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\WizardResults\Sad.png (690 bytes)
%Program Files% (x86)\Rediff Bol\RDKanConv.dll (3402 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Click.png (1 bytes)
%Program Files% (x86)\Rediff Bol\RediffMessenger.exe (102654 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\donttellanyone.gif (297 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Regular.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_rd.gif (220 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Click.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Regular.png (1 bytes)
%Program Files% (x86)\Rediff Bol\RDTamConv.dll (1921 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\phone.wav (784 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\wink_static.gif (235 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_lii.gif (406 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Misc\FTSend.png (2 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\star.gif (541 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Disabled.png (825 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Disabled.png (1 bytes)
C:\Windows\Fonts\Shree853.ttf (1856 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\eyerolling.gif (573 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\DefaultAd.html (841 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\AvatarDisplay\AvatarLoadFailed.png (3 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Misc\FTReceive.png (2 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sarcastic.gif (252 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Regular.png (756 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\Closecall.wav (4 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailAlert.png (828 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\confused.gif (259 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\RingingTone-Old.wav (784 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sleepy.gif (3 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\smsJokes.xml (53 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\offline.wav (9 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sad.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\AvatarDisplay\AvatarNotSet.png (5 bytes)
C:\Windows\Fonts\Shree900.ttf (1856 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_rn.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\online.wav (11 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\QuickReplies.txt (204 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Click.png (1 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\userstatus.xml (294 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Hover.png (610 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Disabled.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Click.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Click.png (792 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\smsJokes.html (69 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\angry_static.gif (241 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\laugh.gif (3 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_rd.gif (388 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Regular.png (1 bytes)
C:\Windows\Fonts\Barani.ttf (2392 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\loading.swf (910 bytes)
%Program Files% (x86)\Rediff Bol\msvcp71.dll (16944 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Hover.png (767 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Hover.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\modern-wizard.bmp (1856 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Hover.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Click.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Hover.png (788 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\eyerolling_static.gif (253 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\hot.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\surprised_static.gif (262 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\MallikaMsg.wav (1552 bytes)
%Program Files% (x86)\Rediff Bol\Fetch.dll (3402 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\embarrassed.gif (242 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\cry_static.gif (326 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\idontknow.gif (244 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Disabled.png (1 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\Talk&See.exe (28288 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_ld.gif (219 bytes)
%Program Files% (x86)\Rediff Bol\RBolHandler.exe (9 bytes)
%Program Files% (x86)\Rediff Bol\msvcr71.dll (12088 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Disabled.png (796 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rediff Bol\Rediff Bol 8.0 Messenger.lnk (902 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\WizardResults\Happy.png (458 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sleepy_static.gif (368 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\audiblemenu.xml (250 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\LanguageOptions.txt (569 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\smile_static.gif (234 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_ld.gif (258 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\Flash.ocx (102659 bytes)
C:\Users\"%CurrentUserName%"\Desktop\Rediff Bol 8.0 Messenger.lnk (884 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\avatars.xml (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sad_static.gif (226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\RediffBolSettings.ini (6675 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\InetLoad.dll (32 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\angel.gif (3 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\angry.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\RDMarConv.dll (3398 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\rediffsms.xml (196 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\angel_static.gif (327 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Disabled.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Hover.png (996 bytes)
%Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\audioport.cfg (6 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\ApplicationIcon.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Click.png (811 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Disabled.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\InstallOptions.dll (28 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\idontknow_static.gif (239 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\BusyTone.wav (1856 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\thinking.gif (3 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Click.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Regular.png (549 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\BolTalkIcon.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\BolChatIcon.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\hot_static.gif (209 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\bol.in.time_pass.xml (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\RingingTone-New.wav (3312 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\MailIcon.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Disabled.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Click.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sick.gif (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Hover.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_rii.gif (401 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sick_static.gif (206 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\System.dll (22 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\donttellanyone_static.gif (240 bytes)
%Program Files% (x86)\Rediff Bol\msvcp60.dll (13584 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\cry.gif (2 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\thinking_static.gif (326 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\surprised.gif (1 bytes)
C:\Windows\Fonts\Webdunia.ttf (1856 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Regular.png (1 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\tongueout_static.gif (233 bytes)
%Program Files% (x86)\Rediff Bol\Client\Resources\Images\AvatarDisplay\AvatarLoading.png (4 bytes)

Registry activity

The process RediffMessenger.exe:1880 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Rediff\Rediff Bol 8.0]
"SignInStatus" = "0"

[HKCU\Software\Rediff\Rediff Bol 8.0\Options]
"AUTOSHOW" = "1"

The process %original file name%.exe:2304 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCR\TypeLib\{3EEE1603-B561-47E4-8D71-B228181F345F}\1.0]
"(Default)" = "Fetch 1.0 Type Library"

[HKCR\RDTamConv.RDTamConverter.1]
"(Default)" = "RDTamConverter Class"

[HKCR\Wow6432Node\CLSID\{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}\VersionIndependentProgID]
"(Default)" = "Fetch.FetchContact"

[HKCR\RdMarConv.RDMarConverter\CurVer]
"(Default)" = "RdMarConv.RDMarConverter.1"

[HKCR\RDKanConv.RDKanConverter]
"(Default)" = "RDKanConverter Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCR\Interface\{9548721B-4D15-479B-B933-2448C47832F2}]
"(Default)" = "IRDKanConverter"

[HKCR\TypeLib\{02676760-67A8-463E-8679-87EA4E8B8BC4}\1.0]
"(Default)" = "RdMarConv 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{769C0340-71B8-472F-9057-ED881688C4F0}\InprocServer32]
"(Default)" = "C:\PROGRA~2\REDIFF~1\RDHINC~1.DLL"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "A8 34 34 66 D6 72 D0 01"

[HKCR\Wow6432Node\CLSID\{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}\ProgID]
"(Default)" = "RDTamConv.RDTamConverter.1"

[HKCR\Wow6432Node\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{4B44E213-0C91-41CB-9414-03EEF035EBAC}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Rediff Bol\"

[HKCR\Wow6432Node\CLSID\{68BCAE3F-651C-49AD-B874-93950190480B}\TypeLib]
"(Default)" = "{02676760-67A8-463E-8679-87EA4E8B8BC4}"

[HKCR\TypeLib\{37BAF053-17BA-4B0D-9AB2-B21E13AFAC04}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Rediff Bol\RDHinConv.dll"

[HKCR\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}]
"(Default)" = "IRDTelConverter"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCR\Wow6432Node\CLSID\{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}\ProgID]
"(Default)" = "RDKanConv.RDKanConverter.1"

[HKCR\Wow6432Node\CLSID\{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}\TypeLib]
"(Default)" = "{3EEE1603-B561-47E4-8D71-B228181F345F}"

[HKCR\Wow6432Node\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Rediff\Rediff Bol 8.0]
"Install_Dir" = "%Program Files% (x86)\Rediff Bol"

[HKCR\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "57 96 8D 77 C0 72 D0 01"

[HKCR\Wow6432Node\CLSID\{769C0340-71B8-472F-9057-ED881688C4F0}\VersionIndependentProgID]
"(Default)" = "RDHinConv.RDHinConverter"

[HKCR\Wow6432Node\CLSID\{68BCAE3F-651C-49AD-B874-93950190480B}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}]
"(Default)" = "RDKanConverter Class"

[HKCR\Fetch.FetchContact\CurVer]
"(Default)" = "Fetch.FetchContact.1"

[HKCR\RDTelConv.RDTelConverter\CurVer]
"(Default)" = "RDTelConv.RDTelConverter.1"

[HKCR\TypeLib\{4B44E213-0C91-41CB-9414-03EEF035EBAC}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Rediff Bol\RDTelConv.dll"

[HKCR\TypeLib\{032AC471-540D-475D-A5C9-C4B2A574AC52}\1.0]
"(Default)" = "RDTamConv 1.0 Type Library"

[HKCR\TypeLib\{3EEE1603-B561-47E4-8D71-B228181F345F}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Rediff Bol\"

[HKCR\Wow6432Node\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{C51FF693-D913-4B68-9A64-295DD8C2BF44}\InprocServer32]
"(Default)" = "C:\PROGRA~2\REDIFF~1\RDMALC~1.DLL"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\Wow6432Node\CLSID\{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rediff Bol]
"UninstallString" = "%Program Files% (x86)\Rediff Bol\uninstall.exe"

[HKCR\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Shree-Mal-0502" = "Shree502.ttf"

[HKCR\Wow6432Node\CLSID\{769C0340-71B8-472F-9057-ED881688C4F0}\ProgID]
"(Default)" = "RDHinConv.RDHinConverter.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rediff Bol]
"NoModify" = "1"

[HKCR\RdMarConv.RDMarConverter.1\CLSID]
"(Default)" = "{68BCAE3F-651C-49AD-B874-93950190480B}"

[HKCR\RDTamConv.RDTamConverter.1\CLSID]
"(Default)" = "{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}"

[HKCR\Interface\{9548721B-4D15-479B-B933-2448C47832F2}\TypeLib]
"Version" = "1.0"

[HKCR\RDKanConv.RDKanConverter\CLSID]
"(Default)" = "{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}"

[HKCR\Fetch.FetchContact\CLSID]
"(Default)" = "{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}"

[HKCR\Wow6432Node\CLSID\{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}\TypeLib]
"(Default)" = "{032AC471-540D-475D-A5C9-C4B2A574AC52}"

[HKCR\TypeLib\{469C0F83-862A-466F-A984-3EB87F02214B}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Rediff Bol\"

[HKCR\TypeLib\{4B44E213-0C91-41CB-9414-03EEF035EBAC}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}\TypeLib]
"(Default)" = "{469C0F83-862A-466F-A984-3EB87F02214B}"

[HKCR\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{02676760-67A8-463E-8679-87EA4E8B8BC4}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Rediff Bol\"

[HKCR\Wow6432Node\CLSID\{68BCAE3F-651C-49AD-B874-93950190480B}\VersionIndependentProgID]
"(Default)" = "RdMarConv.RDMarConverter"

[HKCR\Wow6432Node\CLSID\{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}\ProgID]
"(Default)" = "Fetch.FetchContact.1"

[HKCR\Wow6432Node\CLSID\{75499534-D9DA-41CF-978E-4DF217193AA6}\TypeLib]
"(Default)" = "{4B44E213-0C91-41CB-9414-03EEF035EBAC}"

[HKCR\Wow6432Node\CLSID\{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}\VersionIndependentProgID]
"(Default)" = "RDTamConv.RDTamConverter"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCR\Wow6432Node\Interface\{9548721B-4D15-479B-B933-2448C47832F2}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}]
"(Default)" = "IRDMarConverter"

[HKCR\TypeLib\{37BAF053-17BA-4B0D-9AB2-B21E13AFAC04}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{4B44E213-0C91-41CB-9414-03EEF035EBAC}\1.0]
"(Default)" = "RDTelConv 1.0 Type Library"

[HKCR\Wow6432Node\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}]
"(Default)" = "RDTamConverter Class"

[HKCR\Wow6432Node\CLSID\{C51FF693-D913-4B68-9A64-295DD8C2BF44}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{9548721B-4D15-479B-B933-2448C47832F2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{9548721B-4D15-479B-B933-2448C47832F2}\TypeLib]
"(Default)" = "{F7A217F1-89DC-4349-931F-2EBB42049C2E}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rediff Bol]
"DisplayName" = "Rediff Bol"

[HKCR\Wow6432Node\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}\TypeLib]
"Version" = "1.0"

[HKCR\Fetch.FetchContact.1]
"(Default)" = "FetchContact Class"

[HKCR\Wow6432Node\CLSID\{769C0340-71B8-472F-9057-ED881688C4F0}\TypeLib]
"(Default)" = "{37BAF053-17BA-4B0D-9AB2-B21E13AFAC04}"

[HKCR\RDKanConv.RDKanConverter\CurVer]
"(Default)" = "RDKanConv.RDKanConverter.1"

[HKCU\Software\Rediff\Rediff Bol 8.0]
"(Default)" = ""

[HKCR\RDTelConv.RDTelConverter.1\CLSID]
"(Default)" = "{75499534-D9DA-41CF-978E-4DF217193AA6}"

[HKCR\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\rbol]
"(Default)" = "URL:RBOL PROTOCOL"

[HKCR\TypeLib\{F7A217F1-89DC-4349-931F-2EBB42049C2E}\1.0]
"(Default)" = "RDKanConv 1.0 Type Library"

[HKCR\TypeLib\{F7A217F1-89DC-4349-931F-2EBB42049C2E}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Rediff Bol\RDKanConv.dll"

[HKCR\RDHinConv.RDHinConverter]
"(Default)" = "RDHinConverter Class"

[HKCR\TypeLib\{469C0F83-862A-466F-A984-3EB87F02214B}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}\InprocServer32]
"(Default)" = "C:\PROGRA~2\REDIFF~1\Fetch.dll"

[HKCR\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{F7A217F1-89DC-4349-931F-2EBB42049C2E}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Rediff Bol\"

[HKCR\RDTelConv.RDTelConverter\CLSID]
"(Default)" = "{75499534-D9DA-41CF-978E-4DF217193AA6}"

[HKCR\TypeLib\{469C0F83-862A-466F-A984-3EB87F02214B}\1.0]
"(Default)" = "RDMalConv 1.0 Type Library"

[HKCR\Wow6432Node\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{9548721B-4D15-479B-B933-2448C47832F2}]
"(Default)" = "IRDKanConverter"

[HKCR\Wow6432Node\CLSID\{C51FF693-D913-4B68-9A64-295DD8C2BF44}\VersionIndependentProgID]
"(Default)" = "RDMalConv.RDMalConverter"

[HKCR\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}\TypeLib]
"(Default)" = "{469C0F83-862A-466F-A984-3EB87F02214B}"

[HKCR\Wow6432Node\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}]
"(Default)" = "IRDTamConverter"

[HKCR\Wow6432Node\CLSID\{C51FF693-D913-4B68-9A64-295DD8C2BF44}\TypeLib]
"(Default)" = "{469C0F83-862A-466F-A984-3EB87F02214B}"

[HKCR\Wow6432Node\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}\TypeLib]
"(Default)" = "{02676760-67A8-463E-8679-87EA4E8B8BC4}"

[HKCR\Wow6432Node\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}]
"(Default)" = "IRDMalConverter"

[HKCR\RDHinConv.RDHinConverter\CurVer]
"(Default)" = "RDHinConv.RDHinConverter.1"

[HKCR\Wow6432Node\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}]
"(Default)" = "IRDHinConverter"

[HKCR\Wow6432Node\CLSID\{68BCAE3F-651C-49AD-B874-93950190480B}\ProgID]
"(Default)" = "RdMarConv.RDMarConverter.1"

[HKCR\TypeLib\{02676760-67A8-463E-8679-87EA4E8B8BC4}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}\TypeLib]
"(Default)" = "{4B44E213-0C91-41CB-9414-03EEF035EBAC}"

[HKCR\Wow6432Node\CLSID\{C51FF693-D913-4B68-9A64-295DD8C2BF44}]
"(Default)" = "RDMalConverter Class"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rediff Bol]
"NoRepair" = "1"

[HKCR\RDKanConv.RDKanConverter.1\CLSID]
"(Default)" = "{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}"

[HKCR\RDKanConv.RDKanConverter.1]
"(Default)" = "RDKanConverter Class"

[HKCR\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}]
"(Default)" = "IRDMarConverter"

[HKCR\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}\TypeLib]
"(Default)" = "{02676760-67A8-463E-8679-87EA4E8B8BC4}"

[HKCR\Wow6432Node\CLSID\{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}]
"(Default)" = "FetchContact Class"

[HKCR\Fetch.FetchContact]
"(Default)" = "FetchContact Class"

[HKCR\rbol\shell\open\command]
"(Default)" = "%Program Files% (x86)\Rediff Bol\RBolHandler.exe --rbol=%1"

[HKCR\RDMalConv.RDMalConverter\CLSID]
"(Default)" = "{C51FF693-D913-4B68-9A64-295DD8C2BF44}"

[HKCR\Wow6432Node\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}]
"(Default)" = "IFetchContact"

[HKCR\Wow6432Node\CLSID\{68BCAE3F-651C-49AD-B874-93950190480B}]
"(Default)" = "RDMarConverter Class"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Shree-Kan-0853" = "Shree853.ttf"

[HKCR\RDMalConv.RDMalConverter.1\CLSID]
"(Default)" = "{C51FF693-D913-4B68-9A64-295DD8C2BF44}"

[HKCR\TypeLib\{F7A217F1-89DC-4349-931F-2EBB42049C2E}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCR\TypeLib\{3EEE1603-B561-47E4-8D71-B228181F345F}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\RDTamConv.RDTamConverter]
"(Default)" = "RDTamConverter Class"

[HKCR\Wow6432Node\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\RdMarConv.RDMarConverter]
"(Default)" = "RDMarConverter Class"

[HKCR\Wow6432Node\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}\TypeLib]
"(Default)" = "{37BAF053-17BA-4B0D-9AB2-B21E13AFAC04}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Webdunia" = "Webdunia.ttf"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCR\RDMalConv.RDMalConverter]
"(Default)" = "RDMalConverter Class"

[HKCR\TypeLib\{3EEE1603-B561-47E4-8D71-B228181F345F}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Rediff Bol\Fetch.dll"

[HKCR\Wow6432Node\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}]
"(Default)" = "IRDMalConverter"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCR\Wow6432Node\CLSID\{75499534-D9DA-41CF-978E-4DF217193AA6}]
"(Default)" = "RDTelConverter Class"

[HKCR\RDHinConv.RDHinConverter.1\CLSID]
"(Default)" = "{769C0340-71B8-472F-9057-ED881688C4F0}"

[HKCR\RDMalConv.RDMalConverter\CurVer]
"(Default)" = "RDMalConv.RDMalConverter.1"

[HKCR\TypeLib\{032AC471-540D-475D-A5C9-C4B2A574AC52}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Rediff Bol\"

[HKCR\RDTamConv.RDTamConverter\CLSID]
"(Default)" = "{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}"

[HKCR\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}]
"(Default)" = "IFetchContact"

[HKCR\RDHinConv.RDHinConverter\CLSID]
"(Default)" = "{769C0340-71B8-472F-9057-ED881688C4F0}"

[HKCR\RdMarConv.RDMarConverter.1]
"(Default)" = "RDMarConverter Class"

[HKCR\Fetch.FetchContact.1\CLSID]
"(Default)" = "{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}"

[HKCR\RDTelConv.RDTelConverter.1]
"(Default)" = "RDTelConverter Class"

[HKCR\Wow6432Node\CLSID\{769C0340-71B8-472F-9057-ED881688C4F0}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{75499534-D9DA-41CF-978E-4DF217193AA6}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}\TypeLib]
"(Default)" = "{032AC471-540D-475D-A5C9-C4B2A574AC52}"

[HKCR\Wow6432Node\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}]
"(Default)" = "IRDTelConverter"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCR\RDTamConv.RDTamConverter\CurVer]
"(Default)" = "RDTamConv.RDTamConverter.1"

[HKCR\Wow6432Node\CLSID\{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}\VersionIndependentProgID]
"(Default)" = "RDKanConv.RDKanConverter"

[HKCR\Interface\{78DF5A18-7B74-4043-A8A8-DDA3F7A53C95}\TypeLib]
"(Default)" = "{3EEE1603-B561-47E4-8D71-B228181F345F}"

[HKCR\Interface\{9548721B-4D15-479B-B933-2448C47832F2}\TypeLib]
"(Default)" = "{F7A217F1-89DC-4349-931F-2EBB42049C2E}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{75499534-D9DA-41CF-978E-4DF217193AA6}\ProgID]
"(Default)" = "RDTelConv.RDTelConverter.1"

[HKCR\Wow6432Node\CLSID\{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}\TypeLib]
"(Default)" = "{F7A217F1-89DC-4349-931F-2EBB42049C2E}"

[HKCR\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"LT-TM-Barani" = "Barani.ttf"

[HKCR\Wow6432Node\CLSID\{C51FF693-D913-4B68-9A64-295DD8C2BF44}\ProgID]
"(Default)" = "RDMalConv.RDMalConverter.1"

[HKCR\RdMarConv.RDMarConverter\CLSID]
"(Default)" = "{68BCAE3F-651C-49AD-B874-93950190480B}"

[HKCR\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}\TypeLib]
"(Default)" = "{37BAF053-17BA-4B0D-9AB2-B21E13AFAC04}"

[HKCR\TypeLib\{37BAF053-17BA-4B0D-9AB2-B21E13AFAC04}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\Rediff Bol\"

[HKCR\TypeLib\{032AC471-540D-475D-A5C9-C4B2A574AC52}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Rediff Bol\RDTamConv.dll"

[HKCR\TypeLib\{032AC471-540D-475D-A5C9-C4B2A574AC52}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{9E1D79AE-F0A2-4176-BE9C-FD9BC787E318}\InprocServer32]
"(Default)" = "C:\PROGRA~2\REDIFF~1\RDKANC~1.DLL"

[HKCR\Wow6432Node\CLSID\{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}\TypeLib]
"(Default)" = "{3EEE1603-B561-47E4-8D71-B228181F345F}"

[HKCR\Wow6432Node\CLSID\{FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{75499534-D9DA-41CF-978E-4DF217193AA6}\InprocServer32]
"(Default)" = "C:\PROGRA~2\REDIFF~1\RDTELC~1.DLL"

[HKCR\Wow6432Node\Interface\{810901F4-0CFC-47CC-857B-55DE9291970B}\TypeLib]
"Version" = "1.0"

[HKCR\RDHinConv.RDHinConverter.1]
"(Default)" = "RDHinConverter Class"

[HKCR\Wow6432Node\CLSID\{CACDE0AE-C5CE-4F89-8836-CE91731DCBDC}\InprocServer32]
"(Default)" = "C:\PROGRA~2\REDIFF~1\RDTAMC~1.DLL"

[HKCR\Wow6432Node\CLSID\{68BCAE3F-651C-49AD-B874-93950190480B}\InprocServer32]
"(Default)" = "C:\PROGRA~2\REDIFF~1\RDMARC~1.DLL"

[HKCR\TypeLib\{02676760-67A8-463E-8679-87EA4E8B8BC4}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Rediff Bol\RDMarConv.dll"

[HKCR\Wow6432Node\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}\TypeLib]
"(Default)" = "{032AC471-540D-475D-A5C9-C4B2A574AC52}"

[HKCR\rbol]
"URL Protocol" = ""

[HKCR\TypeLib\{469C0F83-862A-466F-A984-3EB87F02214B}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\Rediff Bol\RDMalConv.dll"

[HKCR\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}\TypeLib]
"(Default)" = "{4B44E213-0C91-41CB-9414-03EEF035EBAC}"

[HKCR\Wow6432Node\CLSID\{769C0340-71B8-472F-9057-ED881688C4F0}]
"(Default)" = "RDHinConverter Class"

[HKCR\TypeLib\{37BAF053-17BA-4B0D-9AB2-B21E13AFAC04}\1.0]
"(Default)" = "RDHinConv 1.0 Type Library"

[HKCR\Wow6432Node\Interface\{9548721B-4D15-479B-B933-2448C47832F2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{6B8A1FF6-3F7A-4521-821B-A23C91D8F07B}]
"(Default)" = "IRDHinConverter"

[HKCR\RDTelConv.RDTelConverter]
"(Default)" = "RDTelConverter Class"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Shree-Tel-0900" = "Shree900.ttf"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCR\RDMalConv.RDMalConverter.1]
"(Default)" = "RDMalConverter Class"

[HKCR\Interface\{67A332C2-C190-492E-95DA-B125B44DF718}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCR\Wow6432Node\CLSID\{75499534-D9DA-41CF-978E-4DF217193AA6}\VersionIndependentProgID]
"(Default)" = "RDTelConv.RDTelConverter"

[HKCR\Interface\{640511CD-B628-4232-A489-D86DEBB60B4B}]
"(Default)" = "IRDTamConverter"

[HKCR\Interface\{10551B39-D52D-4CB3-8FD3-60639003F0FE}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Bol IM" = "%Program Files% (x86)\Rediff Bol\RediffMessenger.exe"

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

bf91266b6313ba3e897ba7c2e9b7505b

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 2
77e4cd898be47e051f3eeb86a484233c
00e9ef5addca25ae071e24b375967e20

URLs

URL	IP
hxxp://a258.w3.akamai.net/bol/Flash.ocx
hxxp://messenger.rediff.com/cgi-bin/newbol/bolinstall.cgi?buildInfo=315	202.54.124.160
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar	87.245.216.26
hxxp://tb.symcd.com/	23.37.43.27
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.215.111
hxxp://ocsp.digicert.com/	93.184.220.29
hxxp://ocsp.verisign.com/	23.37.43.27
hxxp://imdownloads.rediff.com/bol/Flash.ocx	87.245.217.137
dl.toolbar.rediff.com	202.137.237.19
services.addons.mozilla.org	63.245.216.134

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack

Traffic

POST / HTTP/1.1

Host: ocsp.digicert.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 115

Content-Type: application/ocsp-request

Connection: keep-alive

0q0o0M0K0I0... ........._.z....'.5...C....
....a..1a./(..F8.,.........nRT..9...J8.4..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=510836

Content-Type: application/ocsp-response

Date: Thu, 09 Apr 2015 15:03:53 GMT

Etag: "5526471a-1d7"

Expires: Thu, 16 Apr 2015 03:03:53 GMT

Last-Modified: Thu, 09 Apr 2015 09:32:10 GMT

Server: ECS (frf/879E)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........a..1a./(..F8.,......2015040
9091700Z0s0q0I0... ........._.z....'.5...C.........a..1a./(..F8.,.....
....nRT..9...J8.4....20150409091700Z....20150416093200Z0...*.H........
.....Y...N......WW.f.G.s......c...K(.~.>.K.P..%o..;Kcr..k...L._H_.z
.:..m.W.o..|..%;...z..x`.$V).Ox...v.........M.:.c.^.i..=NIi<...c...
.,.....:r...rI........UX..%rV..=.}"; ../{.....,....)........._...L..s[
k\..u.d.!w?.s.F@(..Y..O...B..M.........S.N.....Y/.....^EtHTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=510836..Content-Type:
 application/ocsp-response..Date: Thu, 09 Apr 2015 15:03:53 GMT..Etag:
 "5526471a-1d7"..Expires: Thu, 16 Apr 2015 03:03:53 GMT..Last-Modified
: Thu, 09 Apr 2015 09:32:10 GMT..Server: ECS (frf/879E)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0........a..1a
./(..F8.,......20150409091700Z0s0q0I0... ........._.z....'.5...C......
...a..1a./(..F8.,.........nRT..9...J8.4....20150409091700Z....20150416
093200Z0...*.H.............Y...N......WW.f.G.s......c...K(.~.>.K.P.
.%o..;Kcr..k...L._H_.z.:..m.W.o..|..%;...z..x`.$V).Ox...v.........M.:.
c.^.i..=NIi<...c....,.....:r...rI........UX..%rV..=.}"; ../{.....,.
...)........._...L..s[k\..u.d.!w?.s.F@(..Y..O...B..M.........S.N.....Y
/.....^Et..
<<< skipped >>>

POST / HTTP/1.1

Host: ocsp.verisign.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 115

Content-Type: application/ocsp-request

Connection: keep-alive

0q0o0M0K0I0... [email protected].!......Q...==d6|h.[x....7..b.........H..yv...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=362793, public, no-transform, must-revalidate

Last-Modified: Mon, 6 Apr 2015 19:50:25 GMT

Expires: Mon, 13 Apr 2015 19:50:25 GMT

Date: Thu, 09 Apr 2015 15:03:52 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150406195025Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..b.........H..yv.....201504
06195025Z....20150413195025Z0...*.H..............y..I;.,n....I......l1
...[...B..t......>....*....O..C.....q.t_W..a...oYW.r[r.sV@.....|N..
=.B......d2....t.U[..d......E...d.X....G>..;....B.*&z..H. .^.3.....
<A...m.....a.......r.YR..yF.`AT.cJ...!.A...h....5..CC...x.s..Vz."..
.3..V.a......X".."?pM#.sp f. ........0...0...0..{.........[..I|.....Zm
..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....V
eriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.c
om/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428
000000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 
CA OCSP Responder0.."0...*.H.............0.........Y....h..@..>....
.%.-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l...
..f..;]s!.\"v...|....][email protected]. ..W....n
..*..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<.
.6.....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0.
.. .......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0
L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.
com/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..
i1o...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo..
....E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|.....
<<< skipped >>>

POST / HTTP/1.1

Host: tb.symcd.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 115

Content-Type: application/ocsp-request

Connection: keep-alive

0q0o0M0K0I0... ........1....6..2\ch.-...a.I......4E@=..0O..>.......t..6......0.:..>..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1365

content-transfer-encoding: binary

Cache-Control: max-age=559594, public, no-transform, must-revalidate

Last-Modified: Thu, 9 Apr 2015 02:30:28 GMT

Expires: Thu, 16 Apr 2015 02:30:28 GMT

Date: Thu, 09 Apr 2015 15:03:54 GMT

Connection: keep-alive
0..Q......J0..F.. .....0.....70..30......Aa._.w#...Kk..Z..$A...2015040
9023028Z0s0q0I0... ........1....6..2\ch.-...a.I......4E@=..0O..>...
....t..6......0.:..>....20150409023028Z....20150416023028Z0...*.H..
..............E.y.z... ..L.........k`...O...v.tH........~'d^W...i.g..&
lt;X..W.c....V$.cx.....!.....-....^.?n.U6szh~.$.F _...2>-\..S. ....
....v..}[email protected]....}0....J;.y.A.Z....y..h...A
.Y*..Yl...{4..k..)ux..H.........F....c.,)b.Z....q...I..*k...2.....z0..
v0..r0..Z.......EP!9.n...9......0...*.H........0<1.0...U....US1.0..
.U....Thawte, Inc.1.0...U....Thawte SSL CA0...150225000000Z..150526235
959Z0H1.0...U....US1.0...U....Thawte, Inc.1"0 ..U....Thawte SSL OCSP R
esponder0.."0...*.H.............0.........g...|...d..W....H.c....c....
...u.X?J).^......l".o........S........b-Pb..FSN...].!8d....ON71i.y.kY]
D{..`..u.>.[[7....m .22...N._V%..Q....UZ.l.%...../J..yf...~%n...|..
K.6..|...E.M....1V.....G..a .lj.{..0........%.2....P.E......d988gK.._.
.LOP...H$vm1GX..r5........d0b0...U....0.0...U.%..0... .......0...U....
....0... .....0......0"..U....0...0.1.0...U....TGV-B-31930...*.H......
.......$w.2...A... #T..#."o.f..Q.i.I..e....Z>...g.!...).G... .CGeE.
.....k..?./..,...[v.J..,..I....=(^qi....g.Rh.i..`..............a<..
Y....V.>.W...@./G......2A...vl..6..|W..4.{.....p_.idx.G.A.<..MB.
l..(*.|.R....q"...b8...lg..q$..i..T..*D....>..J.../p.f7.(....%..z..
<<< skipped >>>

GET /bol/Flash.ocx HTTP/1.1

User-Agent: NSIS_INETLOAD

Host: imdownloads.rediff.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 28 Feb 2006 05:47:30 GMT

Content-Type: text/plain

Date: Thu, 09 Apr 2015 15:03:17 GMT

Transfer-Encoding:  chunked

Connection: keep-alive

Connection: Transfer-Encoding
0000A9C6..MZ......................@...................................
............!..L.!This program cannot be run in DOS mode....$......."c
L.f.".f.".f."...(.d."...,.l.".?!1.b.".f.#.9.".....s."..!>.g.".f.".t
.".`!)...".`!(.d."...$.g.".."&.g.".Richf.".........................PE.
.L......?...........!..... [email protected].......................
........p.......................................................P.....
......................P...............................................
....0..p............................text............ .................
. ..`.rdata.......0.......0..............@[email protected]........ ....... ...
[email protected]..`[email protected].........@.
[email protected]....... ..............@[email protected]
[email protected](R) C   Compiler for 32-bit ap
plications, Version 6.0   Build 020321Z  : C:\Flashfarm\depot\main\pla
yer\branches\FlashPlayer\FlashPlayer7_DotReleases\core\kraster.cpp : -
Qvc6 -Qlocation,link,%Program Files%\Microsoft Visual Studio\VC98\Bin
 -nologo -MT -W3 -O1 -I ..\..\generic -I ..\..\..\..\..\vendors\gsm -I
 ..\..\..\shared_tcserver -I ..\..\..\JPEG -I ..\..\..\zlib -I ..\.. -
I ..\..\..\mp3decoder\fhdecoder -I ..\..\..\mp3decoder\fhdecoder\src -
I ..\..\..\mp3decoder\fhdecoder\src\corelibs\mp3dec -I ..\..\..\mp3dec
oder\fhdecoder\src\tools\synctools -I ..\..\..\core -I ..\..\..\remote
 -I ..\..\..\sorenson\SDK\Sorenson -I ..\..\..\sorenson\ArchitectureIn
terface\Macromedia -I ..\..\..\nellymoser -D NDEBUG -D _ATL_MIN_CR
<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=64913

Expires: Fri, 10 Apr 2015 09:05:46 GMT

Date: Thu, 09 Apr 2015 15:03:53 GMT

Content-Range: bytes 900000-1199999/47994403

Content-Length: 300000

Connection: keep-alive
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......
<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1200000-1499999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=64853

Expires: Fri, 10 Apr 2015 09:05:46 GMT

Date: Thu, 09 Apr 2015 15:04:53 GMT

Content-Range: bytes 1200000-1499999/47994403

Content-Length: 300000

Connection: keep-alive
,................L'...UM*..b...."..A.(.P`*.v..f...1.%.`.Xu...X# .d .".
 .B2!.J..U....Z1....ff.Q..)........v.S.B.D.. .U@X..`.AN....A.F.Q.E..U.
4..#=.Vy.b$..H.x...J..V&.Z.q...d....<.v.Q..*..p...,.1`%.Q.........H
.E..k*..Uj ..c ...S..I.Y....gz.aR.. .j...<\.xxE)..t.B..M.R.|..(...,
.Q..QD[_>.c..YcaA"X!T:...[j\...;2J...3.4.{.Mm.,..Q2....t<.Jw7..@
.al .......U .3....<....e%....R.....K.S=.3(.........K.>.|.%Q<
..,..H...X(. ....zg... tAh..Q...,...X1.H.E]kR.V.Q..q,ol.....Z..Hc....X
!.R....1mT...J.E..U.A#....mU...U.....s5.1 ...V2%h.c..........S.....b.&
.*YAj)G...F..#2....U.....C...d..ihR. .D`..J[m..Y.e....7Vv...D#1...X.A,
Z...|.t..KK..X.Z..|.c2..x........X2...Q....%......a.......-.L...S.....
.`...c#....V.... .`..[eB...1Q.b.....w..b....,.dr.Fg..w.b[.....4(.e,6n.
]..y...VWA....e.(T....e.P."cm..[......~G...l....h.f|..[[.m..8....%\K{a
H...6...Ls,....h.2h..p..aHR.K.b..DHu^.u.....W.b/k..l....'2.4M)M.Nhq..L
.-...e..^d...e.2..j`..B...%X1..6.-X.....[...b.. ....a....Q.w..P.....6.
..eaG.Llb0Q.;.f....h!Z...AE........._..j.4.Y...hQ......)..H..B..K=....
..........$}O.[.......P^.p.6....G.T&.9...mw.j...F!..'O........K...M.?.
....J..y....c"......@j4_x.#.......&.....8.n......r=..$_..)?e.u.OB.'...
.V.r.....Z,[email protected].'.."I...S[.........
...%e.........xo/[email protected]\..1.-..vAz...UQ.V.[L....
. qEQ.,.._ET/1..#.wX.-.1..(./.#.c....G..chR....%..X.]........q....]N.F
.Q...\Y..Q.I...[..o_..0..,x*.-y].t2...FB0....c..f.i.....w29..;:-.....u
.......zXKM.].?.........3Fsll|.l.q...7.'..m.......B[....a......:..
<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=1500000-1799999

If-Range: "4b1e700-2dc5623-508c5f506dac8"

Connection: keep-alive

HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=64793

Expires: Fri, 10 Apr 2015 09:05:46 GMT

Date: Thu, 09 Apr 2015 15:05:53 GMT

Content-Range: bytes 1500000-1799999/47994403

Content-Length: 300000

Connection: keep-alive
..d'...oj.H.u{[email protected]~..g}.O......._./..... .....H.kk.
..u..g.<.`.M\.$C.......[.....Q|..Vzy...s4r..0&....9..9I.}@.m Y....9
..1......{..Y...).................&.KWo._;d..o.;.9.....C..W.L...A..l.e
5uz...m.R......y..dA..?..o.B:....CH............p.....>..=s...\.\.Ff
w3.....B....].Y\../[email protected]!..... b..a%*A...|.)#...T..;..[
.T.b.O.....".`....^Uew5...t....N..[ ..).c%.J4R.}E...C..H./.0Y.R.._;K.$
$>...gV.......!8.MS.fhv......fW...9.1....0z......_a.O.2.....@W^da. 
[email protected].$u..Y..../..I....e
lx..#~.Wub.=v...1.B..U.`vk......;..dE....%I.K...4........Cs.i..;.i..$j
)..b0...W`....o2p._w5.......J&0..X...6)M....t."..P>bN.(3W...h.U.fBY
:...]h...rF....yv.5....4Ih.*....C.........>B.$..K._.W.1C[..>d..\
...l.mE.f..... fw.Uv..,......YsL\r.l,h..=..d.....{D........ .c.h.,....
`u7.$/...X.~.[|.V....K..2d}*..Fj.E<.V....9...A.......k)..$..S.Wo.'.
.Y..]*..U.q,..&..W....qZ...c`...t.-d.w.29..6D.z.M....i.N.o.....e._..%i
..M.....Y. .b.."(.4.X..z..T".....:.i...3.T..1..B.E..)...0.g..Z<9!".
..) .>...t/......grw}..y...;.q..).........=....X....flIZ...[..B^.ex
..,......].....\.u}[email protected]<@.A.e!...Zn!.".>-....9......
..H@".C.h-=Vf.x......'.|...HD$..V.J.V.....s.e..........@@......kF.....
..b. !`..6...V....B.....:A..u..........|.f.....g...F..$..mI..{V......Y
... ...i;.Dn.B*i.....?8..!.../~^g..5r.0.C...n=P..K...k>....x.6...A.
7<j.|..&.c.).a...=....m8e.RD...H@-.~.F...0....`.p...|..<\W6q....
.M ..T.5.4..Q;..#.m.d.SU...KI..:..}...r......01...Q.......<..m.
<<< skipped >>>

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive

HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer4.webapp.scl3.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Thu, 09 Apr 2015 15:03:35 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=500

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached
HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer4.webapp.
scl3.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Thu, 09 Apr 2015 15:03:35 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=500..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..

The Malware connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

L$.QRj

PhH%f

D$T%u

SShLIh

SSSSh

D$.PQR

t$

FtPR

SSSSSSSSh

JOINCHATROOM

Hi! Try the new instant messenger - Rediff Bol! It has a great new TALK feature which allows you to talk to just about anyone, anywhere in the world for FREE. It also has other cool features like SMS to any mobile in India, Avatars, exciting Chat rooms and much more...Get on Bol now!

1DoExec()

LoginForm

1OnViewOfflineMsgs()

2RBolProtocolShowOfflineMsgs()

UpdateExe

UpdateExeArg

1UpdateExeLaunched()

Options.AlertEmail

^[0-9] $

Rediff.com

urls.xml

rediffsms.xml

avatars.xml

1DoLogin()

2OnLoginClicked()

Options.AlertContacts

has Invited you to join the conference titled "

Join

NonBolContact.png

Available.png

MobileBuddy.png

Offline.png

OfflineBlocked.png

Blocked.png

Away.png

Busy.png

OnMobile.png

has accepted your invitation and joined you on Rediff Bol with the id

has accepted your invitation and joined you on Rediff Bol.

https

HTTPS

jsproxy.dll

^[0-9]{10}$

^[0-9]{0,10}$

^[0-9](5,5)$

^[0-9]{0,5}$

gatekeeper.rediff.com:1863

Invalid command line option passed for 'server' -

{4D08F69F-C1A8-4b71-9151-4B1E9709A572}

RBolProtocolShowOfflineMsgs

RBolProtocolShowOfflineMsgs()

DoExec

UpdateExeLaunched

UpdateExeLaunched()

DoExec()

nickName

NickNameUpdated

HideAllWindows

UnhideAllWindows

UnhideAllWindows()

HideAllWindows()

NickNameUpdated(const QString&)

Nitro::ClosableTransportCallback

hXXp://

UseHttpProxy

HttpProxyHost

HttpProxyPort

HttpProxyUsername

HttpProxyPassword

UseHttpsProxy

SocksProxyPort

SocksProxyPassword

UseHttpTunneling

SessionManagerImpl::GetLoginServers_Response

SessionManagerImpl::GetLoginServers_Exception

203.199.83.62

RBOL/1.2.5

RBOL/1.2.5 HTTP_CONNECT

RBOL/1.2.5 HTTP

SessionManagerImpl::CleanupTransport

@rediffmail.com

url-template

^\ ?[0-9]*-?[0-9]*$

to join bol

Please choose from one of the supported country codes

Huh!!! Please enter a correct email address, for eg. [email protected] or abc

You haven't selected any address books to import friends from!

Sign in failed. Username/password incorrect

Updating the list of supported address books ...

No contacts were imported from your addressbook(s)!

to join Bol

<b>Your friends have been invited to join you on Bol</b>

QuickReplies.txt

../../Client/Resources/Sounds/RingingTone-New.wav

../../Client/Resources/Sounds/RingingTone-Old.wav

../../Client/Resources/Sounds/BusyTone.wav

../../Client/Resources/Sounds/MessageAlert.wav

BolChatIcon.png

Options.DefaultLanguage

Options.ShowEmoticons

%1 : %2 (%3)

LanguageLabel.png

Talk and see friends...anywhere in the world

Chat.Text.Font

Chat.Text.Color

I am using a new version of Rediff Bol 8.0 that supports messaging in

Options.AlertSound

BolTalkIcon.png

For rediffmail users, you can omit the '@rediffmail.com' suffix.

Text files (*.txt)

Text files (*.txt);;All files (*.*)

ConfirmationDialog.CloseChat

characters. The time taken to deliver this SMS is dependant on the mobile operator's network.

is using another version of Rediff Bol from a mobile device. It might not support some features.

is using another version of Rediff Bol. It might not support some features.

is using a version of Bol that might not support some features

is using an older version of Rediff Bol. It might not support some features.

Options.RecentlyUsedAudibles

Options.DefaultLanguageFontSize

is using an older version of the Bol client which doesn't support the Talk & See feature

ApplicationIcon.png

9xAvailable.png

Joined %1 %2.

Failed to join %1 %2.

Failed to join %1.

ConfirmationDialog.CloseChatRoom

1OnUpdateNickName()

1OnJoinRoom()

</b> has Invited you to join the chat room <b>

RecentlyUsedNick

Create a nickname before entering a chat room

NickName:

You can change your nickname only after ending all the conversations

You are currently using your nickname in

Join Chat Room

You can change your nickname only after you close the chat room window

nickNameUpdateForm

1OnNickNameUpdated(const QString &)

2NickNameUpdated(const QString &)

Join my chat room...

Join a chatroom of your choice

Nickname:

You need to create a nickname, to join a chat room

To join a Chat Room, please select a chat room you want to enter and then click on the join button.

in.rediff.com

/health.htm

userstatus.xml

actionOfflineMsgs

Rediff.com homepage

Show all hidden windows

&Show all hidden windows

SignInPreLogin

Talk with friends...anywhere in the world

Join a chatroom, make new friends

2UnhideAllWindows()

Options.ContactsViewState

8.0.315

's Bol client is udpated.

InformationDialog.MainWindowClose

Unable to login. Please try again, later. [E112]

OfflineMsgs Dialog

CustomStatusMsgs

ConfirmationDialog.Exit

MWSmileyAvailable.png

MWSmileyAway.png

MWSmileyBusy.png

MWSmileyInvisible.png

Options.HideAvatar

Options.ShowProfile

Options.AlertMessage

Options.GroupsView

Options.ShowTrayDialog

Options.DisplayEmailIDs

Options.NextCheckForUpdate

Oops! Login failed. You have entered an incorrect username or password.

We are unable to sign you in.Please try after some time.[E101]

We are unable to sign you in.Please try after some time.[E102]

We are unable to sign you in.Please try after some time.[E120]

We are unable to sign you in.Please try after some time.[E121]

Password

AutoLogin

Important notice

Authorization failure. Please check whether you have entered the correct proxy password in the Connection settings[E108].

has already been sent an invitation to join you on Rediff Bol. Would you like to resend the invitation?

It needs your input to setup connections options and may need support from your system administrator

%%USER_ID%%

%%SESSION_ID%%

%%DISPLAY_NAME%%

%%USER_STATUS%%

%%CLIENT_VERSION%%

%%OFFLINE_MSG%%

.html

document.location.href = '

has been invited to join you on Rediff Bol!

2WelcomeUrlAvailable( const QString &, int, int )

DefaultAd.html

joined the conference

ConfirmationDialog.CloseConference

Join my conference...

actionWebUpdate

&Hide all windows

2HideAllWindows()

loginDialogClientArea

1OnLoginBtnClicked()

2LoginForgotPwd()

1setCanLogin()

Forgot Password?

loginFormClientArea

1SetCanLogin()

../../Client/Resources/Images/WizardResults/Happy.png

../../Client/Resources/Images/WizardResults/Sad.png

<nobr>If your number is registered with some other ID and you want to use it,</nobr><br><nobr>Send SMS: <b>IN username password</b> from your number To: <b>7333</b></nobr>

../../Client/Resources/Images/Misc/MobileIcon.png

<nobr>You can also login in to your Rediff Bol and Rediffmail account from your mobile:</nobr><br><nobr>SMS: <b>IN username password</b> To: <b>7333</b></nobr>

audibleMSG

OnUpdateNickName

OnJoinRoom

OnNickNameUpdated

OnNickNameUpdated(const QString&)

OnJoinRoom()

OnUpdateNickName()

OnForgotPassword

DoLogin

OnViewOfflineMsgs

OnViewOfflineMsgs()

DoLogin()

OnForgotPassword()

LoginDialog

setCanLogin

OnLoginBtnClicked

OnLoginBtnClicked()

setCanLogin()

LoginNewID

LoginForgotPwd

OnLoginClicked

OnLoginClicked()

LoginForgotPwd()

LoginNewID()

SetCanLogin

SetCanLogin()

NickNameUpdateForm

OnNickChange

OnCreateNickLabelClicked

OnChooseNickLabelClicked

OnCreateNickRadioButtonToggled

OnChangeNickLineEditLostFocus

OnChangeNickRadioButtonToggled

OnChooseNickOneToggled

OnChooseNickTwoToggled

OnChooseNickThreeToggled

OnChooseNickCustomToggled

QHttpResponseHeader

OnResponseHeaderReceived(const QHttpResponseHeader&)

OnChooseNickCustomToggled(bool)

OnChooseNickThreeToggled(bool)

OnChooseNickTwoToggled(bool)

OnChooseNickOneToggled(bool)

OnChangeNickRadioButtonToggled(bool)

OnChangeNickLineEditLostFocus()

OnCreateNickRadioButtonToggled(bool)

OnChooseNickLabelClicked()

OnCreateNickLabelClicked()

OnNickChange()

OfflineMsgDialog

UseHttpsOptionChanged

UseHttpsOptionChanged(bool)

login.rediff.com

/bn/managenicks.cgi

nickNameUpdateFormClientArea

1OnResponseHeaderReceived(const QHttpResponseHeader&)

2ResponseHeaderReceived(const QHttpResponseHeader&)

1OnCreateNickRadioButtonToggled( bool )

1OnNickChange()

1OnChangeNickRadioButtonToggled( bool )

1OnChangeNickLineEditLostFocus()

1OnChooseNickOneToggled( bool )

1OnChooseNickTwoToggled( bool )

1OnChooseNickThreeToggled( bool )

1OnChooseNickCustomToggled( bool )

Create nickname

Yes I want to <b>create a nickname</b> (Recommended)

Change nickname

Nickname already in use

Please wait while your nickname is being updated ...

Nickname created successfully

Your nickname is <b>

Nickname update failed

Problem updating nickname. Please try again later.

_nick&auth=1&nick=

?login=

error_msg

offlineMsgDialogClientArea

ConfirmationDialog.CloseOffline

1UseHttpsOptionChanged(bool)

Software\Microsoft\Windows\CurrentVersion\Run

Registry api error - %d

Please enter the complete email address of your friend you want to email to, for e.g., [email protected]

ConfirmationDialog.CloseSMS

im.gif

im_phone.gif

im_mobile.gif

ConfirmationDialog.CloseTabChat

TabbedForm%d

ConfirmationDialog.CloseTabs

<b>User ([email protected]) </b><br>wants to add you as a friend.

^A<,v.dw

*!i.YRUfp$

5i.cV

;%DK]

mailAddressHintLabel

importedContactsCountLabel

eg. [email protected], [email protected]

<font size=" 1"><font face="Tahoma"><b>Your friends have been invited to join you on Bol</b></font></font>

Total contacts imported -

<font color="#870065">The friends you select will be sent invitation to join you in Bol.</font>

Drag and drop this chat window over other chat windows to create tabs and free up your screen.

120 45 1730 2

.B.C.p.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.o.p.t.t.S.t.t.T.U.V.W.X.C.p.Y.p.Z.0.1.2.3.4.5.M.M.M.6.M.7.K.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t

.L.C.8.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.S.w.w.o.t.C#X#Y#Z#0#1#2#3#4#5#6#7#8#9a.a#aaabacadaeafagah.Zai.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t

.L.C.8.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.p.w.D.pajakalamanaoapaqarasatauavawaxayazaAaBaCaDaEaFaGaHaIaJ.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t

.L.C.8#..t.t.t.t.t#..t.S.t.t.t.t.S.S.taK.t.t.t.S.t.S.t#..S.t.t##.t.t.S.t.t.t#..t.t.t.S.t.t.S.S.S.t.t.t.C.kaL.paM.HaN.C.t.S.t.t.t##.t.taOaP.AaQaRaSaTaUaVaWaXaYaZa0a1a2a3a4a5a6a7a8a9b.b#babbbcbdbebfbgbhbibj.zbk#ubl.z.zbm.C.Cbn.pbobp.t.t.t.t.t

.L.C.8.t.t.t.t#..t##.S.S.t#..S.t##.t.t.t#..S.S.t.t.S##.t.S##.t.SaKaK.t##.tbq.t.Sbr.t##.t.t.S.S.S.t.t.tbsaN.vbs#gbt#m#g.S.S.t.t.S.t.S##bu.z.HbvbwbxbybzbAbBbCbDbEbFbGbHbIbJbKbLbMbNbObPbQbRbSbTbUbVbWbXbYbZb0b1b2b3.Ob4#e.pbn.p##.M#g.1.t.t.t.t.t

.L.C.8.t#..S.t#..t.t.t##.t.t#..S.t##.S.t##.t##aK.t.t.tbq.t.tb5.t.tbq.t.t##.t.S.t.t.t.t.t.t.t.S.t.t.t.tb6.x.vb7b8.v.Mb9bq.t.t.t.S#..t.t.MaMc.c#cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczcAcBcCcDcEcFcGcHcI.k.B.p.CcJ.H.CcK#g.t.t.t.t.t

.L.C.8.t##.t.t.S.t##.t.S.S.t.t.t#.aK.t##.t.t.t.t.t.t##.taK.t.t.S.t.t#..S.t.t#..S.S.S##.t.t.t.t.t.t.t.tcLcM.C.z.zcN.zcO.t.taK.t.t##.taK.OcPcQcRcScTcUcVcWcXcYcZc0c1c2c3c4c5c6c7c8c9d.d#dadbdcdddedfdgdhdidjdkdldmdndodpdq#a.kbkdr.Jdsdt.t.t.t.t.t

.L.C.8.t.t.t.t.t####.t.t.t.SaK#..t.t.t.t.taK.t.tbr##.t##.t.taK.t##.t.t.taK.S.taK.taK.t.t.t.t.t.t.t.t.tbs.p.o.o.p.o.pbs##aK.tbr##.tbr.t.OdudvdwdxdydzdAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd0d1d2d3d4d5d6d7drd8d9.MaQ.Ce..t.t.t.t.t

.L.C.8##.t####.t.S.te#ea.t##.t.t.t.tebeced.t#..S.t.t##.t.t.S#..t.t.taK.t.t.Sbr.tbq.t.t.t.t.t.t.t.t.S.Seeefegehei.r.pejekelemeneoep.t.teqereseteuevewexeyezeAeBeCeDeEeFeGeHeIeJeKeLeMeNeOePbUeQeReSeTeUeVeWeXeYeZe0e1e2e3e4.He5e6e7#ue8.t.t.t.t.t

.L.C.8.t.t.t.t.S.S.te9f.f#fafbfcfdfefffgfh#..t##.S.t.S.taK.t##aK.tfifjfkeoflfmfn.t##.t.t.t.t.t.t.t.S.Sfofpfqfrfsftfufvfnfwfxfyfzf#bqaKfAfBfCfDc7fEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf0f1f2f3f4f5f6f7f8f9g.g#gagbgcgdgegf.Igfgg.t.t.t.t.t

.L.C.8.S.t.t.t.t.t.tghgigj.Sfhgk##.Sglgmgn.t##.t.t.t.t.t.t.t.t.t#..tgogpgq.tgrgsgt.t#..t.t.t.t.t.t.S.SgugvgwgxgygzgAgB.tgCgDaK.Sep.t.tgEgFgGgHcygIgJgKgLgMgNgOgPgQgRgSgTgUgVgWgXgYgZg0g1g2g3g4g5g6g7g8g9h.h#hahbhchdgMhehfhghhhihjhk.L.t.t.t.t.t

.L.C.p.M.z.zhlhmhncJhohp.kdqhqhr.c.6hshthuhvhwhw.t.t.Eb5hxbq.t.t.t.Shyfkgq.thzhAhBhv.t.ShCbq#..t.t.SedhDhEbqaK.t.thFhG.6hHhIej.t.t.S.ShJhKhLhMhNhOhPhQhRhShThUhVhWhXhYhZh0h1h2h3h4h5h6h7h8h9i.i#iaibicidieifigihdeiiijikiliminioipiqir.t##.t.t.S

.L.C.p.M.Misd8.Hit.H.k.Hiu#giviwix##.CiyiziAiBiCiDiEiFiGiHiI#.aK.t.SiJiKekaKiLiMiN.t.EiOiLfeiP.tiQiRiSiTiUiViWiXiYiZi0i1i2i3i4i5aK.t.ti6i7i8i9j.j#jajbjcjdjejfjgjhjijjjkjljmjna2jojpjqjrjsjtjujvjwjxjyjzjAjBjCjDjEjFjGjHdPjIjJjKjLjMjNjO.t.tbr.t

.L.C.pjP.C#i.ujQaMjR#ujS.wjTjUjVjW.MjXjYjZj0iyj1j2iAj3ebj4j5j6.taK.te9j7eoj8gpj9k..tk#ka##kbf.hDkab5bqkckdkekfkgkhkikjkkklkmkngj.t.taKkokpkqkrksktkukvkwkxkykzkAkBkChTkDkEkFkGkHkIkJkKkLkMkNkOkPkQkRkSkTkUkVkWkXkYkZk0k1k2k3k4k5k6k7k8k9e#.t##.t

.L.C.p.Cl.bkl#lalblcldlelflglhlilj.H#elklllm.MlnlolplqlrlsgCec##.tbqltlulvlwlxly.MlzlAlBlClDlElulF.MlGlHlIlJlKlLejlMlN.MlOlPlQ.t.S#..t#alRlSlTlUlVlWlXlYlZl0l1l2l3l4l5l6l7l8l9m.m#mambfUmcmdmemfmgmhkLmimjmkmlmmmnmompmqmrmsmtmumvmwmxhx.t.t##.t

.L.C.p.v.CmymzmAmBmCmDmEmFmGmHmI.k#umJmKmL.M.6mMmNmOmPbq.t.t.t.t.S.Si5mQmRmSmTmUmVmWlAmX.M.M.MmYmZlQ.Mm0i2m1m2lKm3m4m5m6m7llejaK.t##aK.tm8m9n.n#nanbncndnenfngnhninjnknlnmnnnonpnqnrnsntnunvnwnxnynznAnBnCnDnEnFnGnHnIjBnJnKnLnMnNnO#e.SaK.S.t.t

.L.C.p.t.LnPnQnRnSnTnUnVnWiunXnYnZ.C#jm7n0n1.Mn2n3n4mYn5n6n7n8mS.M.Mn7n9o..Mo#lIoaoboclModoeofogohoiojokolomonoo#gnXop.Moqor#f.t.t.t.t.9dqosotouovowoxoyozoAoBoCoDoEoFoGoHoIoJoKoLoMoNoOoPoQoRoSoTd4oUoVoWoXoYoZo0o1o2o3o4o5juo6o7o8o9.S.t.t.t#.

.L.C.p.Mp..Op#padqpb.v.tpcpdpepfpgn6aNlophpi#fpjpkplpmpnpopppq.MmSpriWpsptpupvpwpxpypzi3kmpAi4pBpCoapDpEpFpGpHpIpJpKpLpMpNphpO##.t#..t.6.wpPpQpRpSpTpUpVpWpXpYpZp0p1p2p3p4p5p6p7p8p9q.q#qaqbqcqdqeqfqgqhqiqjqkqljwqmqnqoqpqqqrqsqtqu.C.t.t.t##.t

.L.C.pjTqvqwqxqyqzqA.x.kqBqCqDqEqF#fqGkklkqH#fqIqJpwoiqKqLqM.M.x.xqNqOqPlDn8qQ.MpwqRqSqTqUqV.5.6qWlHqRqXqYqZq0q1q2q3q1q4q5q6q7.t.t.t.t#kaiq8q9r.r#rarbrcrdrepZrfrgrhrirjrkrldecArmrnrorprqrrrsrtrurvrwrxryrzrArBrCh7rDrErFkYrGrHrIrJrK.t.S.S.t.S

.L.C.prL.M#srMrNrOd8#p.6.6.6.6.6.6.6.6.M.M.M.M.M.M.M.M.x.x.x.x.x.x.x.x.S.S.S.S.t.t.t.t.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.M.prPparQ.vrRrS.zdrrTrUrVrWrXrYrZoBr0r1r2dgr3r4r5r6r7gPdhr8r9s.s#sasbscsdsea2sfsgshkusisjskhTslsmsnsospsqsrssst.t.t.t.t.t

.L.C.pqvd8b6surPsv.Nsw.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.O.F.F.F.F.F.F.F.F.F.F.F.F.F.F.F.Fpapapapapapapapa#r#r#r#r#r#r#r#rsxsybprOd8.k.M#pggjQ.F#sszsAsBsCeEsDsEsFsGsHsIsJsKsLsMsNdXr5sOsPsQsRsSsTsUsVsWsXsYsZs0s1s2s3d.s4s5s6s7s8s9t.t#ta.t.t.t.t.t

.L.C.ptb.zdqtctdbpb7te.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k#g#g#g#g#g#g#g#g.k.k.k.k.k.k.k.k.k.k.k.k.k.k.k.ktf.1tg.9aMth.N.O#fqv.9titjtktltmtndZtotptqtrtsttkvddlWtutvtwtxtytztAtBtCtDtEtFtGtHtItJtKtLtMtNbYtOtPtQtRtStTtUtV.t.t.t.t.t

.L.C.p.Mbu.CtWtXtYtZ.z.C.C.C.C.C.C.C.Cqvqvqvqvqvqvqvqv.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.9.9.9.9.9.9.9.9.t.t.t.t.t.t.t.t#Epa.zt0.M#V.pt1t2t3t4t5t6t7t8sHt9u.u#uaubucuduesRsDufuguhuiujukrdulumkvunuoupuqurusutuuuvuwuxuyuzuAtRuBuCuDuE.k.t.t.t.t.t

.L.C.p.MuFjSuGuHuIuJuKuLuLuLuLuLuLuLuLuMuMuMuMuMuMuMuMuNuNuNuNuNuNuNuNuNuNuNuNuOuOuOuOuPuPuPuPuPuPuPuPuOuOuOuOuOuOuNuNuQuRuSuTuUuVuWuXuYuZu0u1u2u3u4u5cVu6u7u8u9v.v#vavbvcvdvevfvgvhvivjugvkvlvmuioZvnvovpvqcUvrvsvtvuvvvwvxvyvzvA.HvB.t.t.t.t.t

.L.C.p.FvCvDvEvFvGvHvIvJvJvJvJvJvJvJvJvJvJvJvJvJvJvJvJvKvKvKvKvKvKvKvKvLvLvMvMvMvMvMvMvKvKvKvKvKvKvKvKvNvNvNvOvOvOvOvOvPvQvRtVvSvTvUvVvWvXvYvZv0lVv1v2v3v4v5v6v7v8v9w.w#wawbc6wcwdwewfwgwhwiwjwkwlwmwnwowpwqwrwswtwuwvwwwxwywz#y.zwA#g.t.t.t.t.t

.L.C.pwBtedrwCwDwEwFwGwHwHwHwHwHwHwHwHwIwIwIwIwIwIwIwIwJwJwJwJwJwJwJwJwJwJwJwKwKwKwKwKwLwLwLwLwLwLwLwLwMwMwMwNwNwOwOwOwPwQqv#W#fwRwSwuwTwUwVwWwXwYwZw0w1w2w3w4w5w6w7w8w9x.x#xaxbxcxdxexfxgxhxixjcjxkxlxmxnxoxpxqxrxsxtxuxvxwxxxy.H.Cxz.t.t.t.t.t

.L.C.p.X.AxA.NvC.A.Hd8.C.C.C.C.C.C.C.C.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.paMaMaM.k.M#p.CxB#jxCxDxEvaxFxGxHxIxJxKxLxMxNxOxP.JkocKxQxRxSxTxUxVxWxXxYxZx0x1x2x3x4x5x6x7x8x9y.y#yaybycyd#g.zdq.vye.V.t.t.t.t.t

.L.C.p.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.p.p.p.p.p.8yfygyhyiyjykylykymynyoypyqyr.w.8.t.t.wysys.QytyuyvywyxyyyzxuyAyByCyDyEyFyGyHyIyJyKyL.S.S.S.t.t.t.t.t.t.t.t.t.t

.L.C.p.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.o.8.p.8.o.p.pyMyNyOyPyQyQyRySyTyUyVyr.w.p.t.t.9.w.w#e.w.w.O.QyWyXyYyZy0y1gjy2oey3y4y5y6y7.p.p.p.S.S.S.t.t.t.t.t.t.t.t.t.t

.L.C.p.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.8.p.p.p.o.8.p.paM.p.p.haM.p.py7.w.w.p.p.S.t.t.t.c.p.p.p.p.w.w.w.Iy8y9.w.p.p.L.L.C.C.C.C.C.C.cz..t.t.t.t.t.t.t.t.t.t.t.t.t

.L.C.p.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.S##.S.t.t.t.S#..C.cz#.C.C.c.C.C.o.S.t.t.9.t.t.t.z.C.C.C.cz#.h.h.C.C.p.p.p.8qv.wz#.c.c.c.c.c.C.C.t.t.t.t.t.t.S.S.t.t.t.t.t

.L.C.p.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.t.taK.t.t.t.t.t.S.t##.t.t####.t.t.t.S.t.t.t.t.t.p.p.9.t.t.t.t.t.p.8lG.x.x.t.t.t.t.t.S.S.S.S.t.t.S##.t.t.t.t.t.t.t.t.t.t.t.t.t

nickNameLabel

updateNickNameButton

changeNickNameButton

joinRoomButton

UpdateNickName

<user> has Invited you to join the chat room <room>

Join Room

textLabelMsg

lineEditChatRoomMsg

17 14 171 2

.P.Q.R.S.T.U.V.W.X.Y.Z.0.1.2.3.4.e

.5.6.7.8.9#.###a#b#c#d#e#f#g#h#i#j

.e.e.e.e.eahaiajakalamanaoapaq.e.e

.e.e.e.e.earasatauavawaxayaz.e.e.e

.e.e.e.e.e.eaAaBaCaDaEaFaG.e.e.e.e

.e.e.e.e.e.eaHaIaJaKaL.e.e.e.e.e.e

.e.e.e.e.e.e.eaMaNaO.l.e.e.e.e.e.e

preLoginPage

preLoginPageLayout

postLoginPage

postLoginPageLayout

<font face="Tahoma">e.g. [email protected] or 9821112345</font>

You have no friends in your list.Click below to add friends with their -

lineEditConfMsg

checkBoxAutoLogin

textLabelNick

checkBoxSavePassword

passwordLabel

editPassword

textLabelErrorMsg

Forgot password?

LoginDialogClientArea::setCanLogin(): Not implemented yet

LoginDialogClientArea::setNickNameState(): Not implemented yet

202 30 560 2

Qt.#.#.#.#.#.#.#.#.Z.0.1.2.w.3.4.5.6.7.8.9.h.h.h.h.h.h.O#.###a#b#c.##d#e#f.##g.r.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.q#L#M#N#O#P.##Q#R#S#T#U#V.N#W#X#Y#Z#V#0#1#2#3#4.H#5#6#7#8#9.#.#.#.#.#.#.#.#.#.#.#.#Qta.a.a.a.a.a.a##D.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.b.ba..##Gaa#G.#.#.#ab.b.b.b.b.##E.c.b.b.b.H.#.#.#.#.#acadadadadadadae#K.#.#.#.#.#.#.#.#.#.#.#.#.#aeaaaa#J.#.#.#.#.#afagahaiajak.#.#.#.#.#.#akajaiahajak.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.#.#.#alam.#anaoapaqarasatauavawaxayazaAaBaCaDaEaFaGaHaIaJaK.#.#.#.#.#.#.#.#.#.#.#.#.H.b.b.b.b.b.b.b.bab.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.b.ba..##F#G#F.#.##E.b.baLa..c.#aM.b.baNa..H.#.#.#.#.#adaaaaaaaaaaaaaaaO#I.#.#.#.#.#.#.#.#.#.#.#.#aeaaaa#J.#.#.#.#aP.b.bahaQ.baR.#.#.#.#.#.#aS.baTaT.baSak.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.#.#.#aUaV.#aWaXaYaZa0a1a2a3a4a5a6a7a8a9b.b#babbbcbdbebfbgbhbi.#.#.#.#.#.#.#.#.#.#.#.H.b.ba##D#D.H.b.b.bbj.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.b.ba..#.#.#.#.#.#.H.b.bbk.#.#.#.b.baN.#.#.#.#.#.#.#.#adaaaaae#Jblbmaaaaae.#.#.#.#.#.#.#.#.#.#.#.#aeaaaa#J.#.#.#.#aR.baP.#.#aR.baP.#.#.#.#.d.baR.#.#aR.baj.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.#.#bnbobp.#bqaQbrbsbtbubvbwbxbybxbzbAbBbCbD.b.bbEbFbGbHbIbJbKbL.#.#.#.#.#.#.#.#.#.#.H.b.b.H.#.#.#aN.b.b#D.#.#bja#aL.b.baM#D.#.#.#.#bkaN.baLa#.b.ba..#Qta.a.#Eab.c.b.baNa..Ha..b.baLa.a..#.#.#.#.#.#adaaaa#J.#.#aeaaaaae.#.#.#bladaaaabmbM#K.#.#aeaaaa#J.#.#.#.#aTaT.#.#.#.p.b.d.#.#.#.#aR.baf.#.#ak.bah.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.#.#bNbObPbQbRbSbTbUbVbWbXbYbZbxa6b0b1b2b3b4b5b6b7.#b8b9c..9c#cacb.#.#.#.#.#.#.#.#.#.H.b.b.H.#.#.#aN.b.bbj.##EaL.b.b.b.b.b.b#D.#.#.H.b.b.b.b.b.b.ba..#.H.b.b#Da..b.b.b.b.b.H.b.b.b.b.b.b.#.#.#.#.#.#adaaaa#J.##KccaaaO#I.#.#aeaaaaaaaaaaaaaO#K.#aeaaaa#J.#.#.#.#aR.bahaP.#aiaTak.#.#.#.#ah.b.#.#.#.#aQaQ.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.#cdcecfcgchcicj.b.bckclcmcncocpcqcrcsctcucvcwcxcyczcA.P.9.h.hcBcC.#.#.#.#.#.#.#.#.#.H.b.ba##D#DaM.b.ba..#.#a..b.cbj.##DaL.baM.#bj.b.b.bQt.##H.b.ba..#.H.b.b#D#Ea#.b.b.H#D#E#D.b.baN#D#D.#.#.#.#.#.#adaaaaaaaaaaaaaObl.#.##IaaaaaOcD.#bMaaaabM.#aeaaaa#J.#.#.#.#akai.b.baQ.baf.#.#.#.#.#ah.b.#.#.#.#ah.b.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.#cEcFcGcHcIcJcKcLcMcNcObZb1cPcQcqcRcncScTcUcVcWcXcY.P.O.h.h.h.hcZc0.#.#.#.#.#.#.#.#.H.b.b.b.b.b.b.baM#H.#bj.b.ba..H.H.H.c.b.b.#Qt.b.ba#.#.#.#.b.ba..#.H.b.b#D.#.H.b.b#D.#.#.#.b.ba..#.#.#.#.#.#.#.#adaaaaaaaaaaaaaaaac1.#aeaaaabM.#.##IaaaaaO.#aeaaaa#J.#.#.#.#.d.baR.0aQ.bahak.#.#.#.#ah.b.#.#.#.#ah.b.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#c2c3c4cfcfc5c6c7c8c9d.d#b1b1cSdadbdccScScSb1dddedfdg.9.h.h.h.h.h.hdhdi.#.#.#.#.#.#.#.H.b.b.caN.b.b.b#D.#.##D.b.b.b.b.b.b.b.b.b.#.H.b.b.H.#.#.#.b.ba..#.H.b.b#D.#.H.b.b#D.#.#.#.b.ba..#.#.#.#.#.#.#.#adaaaa#J.#.##JaOaaaa#Iaeaaaaae.#.#.#aaaaaa.#aeaaaa#J.#.#.#.#aTaS.#.#akaR.baj.#.#.#.#ah.b.#.#.#.#aSaT.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#djdkdlcGdmdn#sdodpdqdrdsdtcScScSbzcqcncScScSdudvdw.O#r.h.h.h.h.h.h.hdxdy.#.#.#.#.#.#.#.H.b.b.H.#aM.b.baL#H.##D.b.baM#D#D#D#D#D#D.#.H.b.bab.#.#.#.b.ba..#.H.b.b#D.#.H.b.b#D.#.#.#.b.ba..#.#.#.#.#.#.#.#adaaaa#J.#.#.#adaaaa#Jaeaaaaac.#.#.#aaaaaa.#aeaaaa#J.#.#.#dz.bag.#.#.#af.bah.#.#.#.#ai.baP.#.#.#.bah.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#dAdBdCdmdDdE.9#rdFdGdHdIdJcncScScTcqdKcScScSb1dLdM#W#s.h.h.h.h.h.h.hdNdO.#.#.#.#.#.#.#.H.b.b.H.##H.c.b.baN.#.#aL.baL#E.#.#.##D.H.##D.b.baL#E.##D.b.ba..#.H.b.b#D.#.H.b.b#D.#.#.#.b.ba..#.#.#.#.#.#.#.#adaaaa#J.#.##JaOaaaa#IcDaaaabm#K.#aeaaaadP.#aeaaaa#J.#.#.#.#aQaTak.#.#.d.b.d.dah.d.#aj.baj.#.#aj.bag.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#dQdRcGdSdT.OdU.h#s#WdVdWdXcSdudcdudYctcncScSb1dKdZd0.O.h.h.h.h.h.h.hc#d1d2.#.#.#.#.#.#.H.b.b.H.#.##E.b.b.bab.#Qt.b.b.baNa..c.ba..#.#aN.b.b.b.b.b.b.ba..#.H.b.b#D.#.H.b.b#D.#.#.#.b.ba..#.#.#.#.#.#.#.#adaaaaaaaaaaaaaaaaac.#.#dPaaaabmadaaaaaacD.#aeaaaa#J.#.#.#.#aj.baQagai.baQ.#.0.b.0.#akaT.baiai.baTaP.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.wd3d4dmd5d6.h#r.h#td7d8d9e.ducRe#ducqcpdccScSdccpdLeaeb.h.h.h.h.h.h.h.heced.#.#.#.#.#.#.H.b.b.H.#.#.#.H.b.b.bQt.#bk.c.b.b.b.baL.H.#.##E.c.b.baL.H.b.ba..#.H.b.b#D.#.H.b.b#D.#.#.#.b.ba..#.#.#.#.#.#.#.#adaaaaaaaaaaaaadbl.#.#.##Kacaaaaaaaabm#J.#.#aeaaaa#J.#.#.#.#.#.0aS.baTaRaP.#.dah.d.#.#aPaiaTaTaiaf.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#eeefegd5dmeh.h#r.heiejekelemenbze#dKdYeodccScnduepeqeresdU.h.h.h.h.h.h.heteu.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#bj#D#D#E.#.#.#.#.#.##E#D#H.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.##J#J#I.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#evewexeycfez.OdU.h.NeAeBeCeDeEcRcncTeFeodccnb1eGeHeIeJ.hdU.h.h.h.h.h.h.heKeL.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#eMeNdDeycGeO#sdU.ObJePeQeReSeTeUdudKeVeodccSbxeWeXeYeZe0.h.h.h.h.h.h.h.he1e2.#.#.#.#.#.#Qta.a.#EabaM#H#Eab.#.Ha.aM#DQta.a.a.ab.#.Ha.#H.#Qta.#E.#a..#a.a.a.a.#E.#.#abaM.#bja.QtQta.a.a..#.Ha.aM#D.#.Ha.aM#D#Ea.a.a.#EabaM#H#Eab.##Ea#a.a#bjQta.a.a..#a.a.a.#E.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#e3e4c4dmdmdCe5.9.h.9bJe6e7e8e9f.cRcTf#facSbyfbfcfdfefffg.O.h.h.h.h.h.h.hecfh.#.#.#.#.#.#bjaNa##Ha..ba##Da.#E.bQtbkbkbj#D.b.H#E.#aL.b.H.#.H.baN#H.b.##Da#aN#D#H.#.#a..bQt.H.b.H.HaN#D#D#E.bQtbkbk#E.bQtbkbk#D.b#D#D#Ha..ba##Da.#HaLa##D.H#E.HaN#D#D.#.b.HaMa..#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#dAfic4cfdmdDfj.9.9.h#rfkflfmfnfofpeobzdaepfqfrfsftfufv.9.h.h.h.h.h.h.h.hfwfx.#.#.#.#.#.#.#a..H.#a..H.ba#a.#HaN.baN#D.#.#.b#D.#bkaL.HaN.#.Hab.ca#.b.#.#.Ha..#.#.#.#a.a.aN.caN.H.H.b.ba.#HaN.baN#D#HaN.baN#D#D.b.b.b.#a..H.ba#a.#D.b.#.H.Hbj.H.b.ba..#.baNaLQt.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#fydRfzcfcGcGfA.O.9.h.hbJfBfCfDfEfFfGcQcqfHfIfJfDfKfLdU.h.h.h.h.h.h.h.hfMfNdy.#.#.#.#.#.#.#a..H.#a.#D.H.ba.bj#E#Ea.a..#.#.b#D.#aMaLaN.b#E.H.H#E.b.b.#.#.Ha..#.#.#.#a..Ha..Ha..H.Ha..#.#bj#E#Ea.a.bj#E#Ea.a.#D.b.#.#.#a.#D.H.ba.bj.bQt.H.b#D.Ha..#.#.#.b.H.bQt.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#c2fOfPcfcGcGdDfQ.9.h.h.hfRfSfTfUfUfVfWfXfYfZf0f1f2.9.h.h.h.h.h.h.h.h.hf3ed.#.#.#.#.#.#.#.H.b.b#Da.#D.#aMa.#E.c.b.c#D.#.#.b#D#H.b.H#DaNab.H.H.#.H.b.#.#.Ha..#.#.#.#a..H.#.#a..H.H.b.b.b#E.c.b.c#D#E.c.b.c#D#D.b.b.b#Da.#D.#aMa..#QtaL.b.c#E.H.b.b.b.#.b#D.HaL#E.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.wf4f5dmcGcGcGdTe5dU.9.h.9.9f6f7f8fUf9g.g#gagbgcgd.9.h.h.h.h.h.h.h.hgegf.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#d2ggghcfcGcGcfdTdE#rdU.O.9gigjgkglgmgngogpgqgrgs.9.h.h.h.h.h.h.hgtgu.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#gvgwgxcGcGcGd5exc..hbJ#r.9gigygzgAgBgCcrgDgE.9.h.9dU.h.h.h.hgFfx.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

Qt.#.#.#.#.#.#.#.#.#gGgHgIfzcGcfdmgJehei.O#rgKgLffgMd0gNgOgPgQfR#r.O.O.OgRgSgTc0.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#.#Qt

textLabelNewUserMsg

textLabelUserIdMsg

Enter your Password

LoginFormClientArea::setCanLogin(): Not implemented yet

LoginFormClientArea::setNickNameState(): Not implemented yet

"B.rK

textLabelTitleMsg

Webdings

9840012345

<nobr>Send SMS: <b>IN username password</b> from your number To: <b>7333</b></nobr>

LoginDialogClientArea

setNickNameState

setNickNameState()

LoginFormClientArea

NickNameUpdateFormClientArea

OfflineMsgDialogClientArea

111 30 32 1

...................................................................dmjjjjnoppiqqqrqrrjjjjmhba..................

................................................................djjrqqkttsnnsttlqqqiwqqqqqqqrjukbg.............

...............................................................dujqqqqstpujrmnpnqqitpqqqqqqqqqrjukx#...........

..............................................................aujqqqqhttvrqqqjjjqqttnrqqqqqqqqqqrujl#..........

..............................................................hjqqqqqptsuqqqqqqqqitsvrqqqqqqqqqqqqrume.........

....#f......fae..............................fe.g#..#dcfbla..#jrqqqqwstprqqqqqqqqltpjqqqqqqqqqqqqqqqjjc........

....emhlmmdhvmm............emudlhb..........#mmgyz#acevmemh#.ejqqqqqqottiqqqqqqqqstvrwqqqqwwiwqqqqwoppocA#.....

....bh#.mm.#lhv.............eud#lua..........cvgBB.hc.bm.#a..burqqqqqittoqqqqqqqhtpmotpwqqhtssowqqhttttssCCA...

....ff..mm...dm###...#f.....aud.aud...g#...#ecm#...vc.cm.....ajrqqqqqqnttowwwwqqsttttttkqqhtsttsiqqmvnptststC..

.......#mm#..bvbhma.ccll....xud.cux..cchb.bcdum#hcbuhcmuca...Avrqqqqqqqntttstsqltttonttrqqqvvvptoqqrrmsspnsssf.

........mm...cvabvhbmfcue...auldub..lh#hmdhg#hvfulfvlehmb#....luqqqwqqqrvpttttistsnuntsjwlopnmmtpqqqqotsuuuvvc.

ggggg#..vm#..bm..dhmuuuuf...xuhduc.fuuuuuuc..cmgll#vc.cm#.....eujqqqwqqqqjvnnvjpsvurstnisttttsstnrqqwttnjjvdbf.

yyyyyyg.vm...cv..dmvh#..#...auc#dufaub###ub..cmghl#vb.dm#......durqqqqwqqqrrrjwwujrittnotnnvnttsuqqqotsjrrjb...

yydyyc.#vv#..du.#dhlubgea...eud.#mvavvf#bvvf#lm#hh.vc.dv.......fhuqqwqqqqwqqqqqqqqqltsvssjjjjptnrqqittnjqqud...

zD.#D.#duud##hue.kuxmuhdf..ahuvc#fmldvvlcevvldvdvmbuhehub.......xmjrqqwqwqqwqqqqqqqltpjstoqqitpuqqqotsjrqrjd...

z.....#ebbe#.eef#xbfgbcf...feeba..#effcb##fce#beeeeeeaeba........xmrqwqqqqqqwqqqqqqinvristolstvrqqkttnrqqrud...

z#.....................................#.........................gvrqqqwqwqqqqwqqqqqrjqqmptttpjqqqotpjqqqjjc#..

z................................................................cuwqwqqqqwqwqqqwqqqqqqqqjntsurqqittnrqqrjhe#..

z...............................................................burqqqqwqrwqqqwqqqwqqqqqqqqpnrqqqltsuqqrjvca...

z.........................................................#.#.adjjqqqwqqrujrrqqqqqqwqqqqqqqruqqqwstnrqruvde#...

yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyz.alddmjurqqqqqqrumhvujrwrqqqqqqqqqqqqqqqqhnujjukda#....

yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyz..juurrqqqqqqqruvdbclmuujrrrqqqqqqqqqqqqqjuujvhce#.....

DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD..evujqrrqrqjjumdxgggeclmvujjujjjjjrjjjujuvklcbf#......

...........................................................gacdhhhhllcbf#......##ggxeebccddddccbbeaf#..........

............................................................#ffxeeexxfg#.............gfggg##gggg#..............

NickNameUpdateFormClientAreaLayout

WSCreateNickName

createNickRadioButton

nickNameCaption

createNickLineEdit

WSChangeNickName

changeNickRadioButton

changeNickLineEdit

WSChooseNickName

chooseNickOne

chooseNickTwo

chooseNickThree

chooseNickCustom

chooseNickLineEdit

WSUpdatedNickName

updatedNickLabel

failureMsgLabel

WSUpdatingNickName

updatingMsgLabel

Update nickname

<b>Create your nickname:</b>

Create a nickname to enter chat room of your choice. Chatting with a nickname is safe and anonymous

Desired nickname:

<font color="#ff0000">(Using your id as nickname may expose you to spam)</font>

<b>Change your nickname:</b>

Use a nickname to enter chat room of your choice. Chatting with a nickname is safe and anonymous.

Enter a nickname of your choice (Recommended)

<b><font color="#ff0000">NickName is already in use</font></b>

<b>Or</b> Create another nickname -

:) Nickname created successfully!

Your nickname is NickName

Now you can start chatting with the nickname you just created.

Nickname updation failed!

<b>Updating nickName to ...</b>

OfflineMsgDialogClientAreaLayout

activeTextEditMsg

22 20 341 2

QtQtQtQtQtQtQtQtQt.#.a.b.cQtQtQtQtQtQtQtQtQt

QtQt.d.e.f.g.h.i.j.k.l.m.n.o.pQtQtQtQtQtQtQt

Qt.q.r.s.t.u.v.w.x.y.z.A.B.C.D.E.F.G.H.IQtQt

Qt.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.0.1.2.3

Qt.4.5.6.7.8.9#.###a#b#c#d#e#f#g#h#i#j#k#l#m

QtQtaUaVaWaXaYaZa0a1a2a3a4a5a6a7a8a9b.agb#ba

QtcYcZc0c1c2c3c4c5c6cRc7c8c9d.QtQtQtQtQtQtQt

QtQt.ed#dadbdc.wdddedfdgdhdiQtQtQtQtQtQtQtQt

22 20 204 2

QtQt.#.a.bQtQtQtQtQtQtQtQt.cQtQtQtQtQtQtQtQt

QtQt.d.e.fQtQtQtQtQtQtQt.g.h.iQtQtQtQtQtQtQt

QtQt.j.k.l.mQtQtQt.n.o.p.q.r.s.tQtQtQtQtQtQt

QtQt.u.v.w.xQt.y.z.A.B.C.D.E.F.G.HQtQtQtQtQt

QtQtQt.I.J.K.L.M.N.O.P.Q.R.S.T.U.VQtQtQtQtQt

QtQtQt.W.X.Y.Z.0.1.2.3.4.5.6.7.8.9#.QtQtQtQt

httpProxyHostEdit

httpProxyPortEdit

httpProxyUsernameEdit

httpProxyPasswordEdit

socksProxyPasswordEdit

socksProxyPortEdit

useHttpTunnelingCheckBox

useHttpProxyRadioButton

useHttpsProxyCheckBox

testHttpConnectionButton

<nobr>Just SMS: <b>IN username password</b> To: <b>7333</b></nobr>

Automatically run Rediff messenger when I log on to Windows

Allow connection through port 80

Set HTTP proxy

Port:

Password:

Type the username & password only if required by your network

Connect using HTTPS

TrayDialogClientArea::setCanLogin(): Not implemented yet

TrayDialogClientArea::setNickNameState(): Not implemented yet

textMsgLimitInfo

<font face="Tahoma">Yahoo Password:</font>

You have cancelled the process of importing your Yahoo Address Book. No addresses have been imported.

FF5FBF73-A8AC-4756-BF8F-2B3C95B253D2

1OnAdResponseHeaderReceived(const QHttpResponseHeader&)

launchurl

/grey.swf

/loading.swf

{d27cdb6e-ae6d-11cf-96b8-444553540000}

newbol/Talkies/update.txt

audiblemenu.xml

1OnHttpFetchFinished(int, bool)

bol.in.time_pass

bol.in.c_ya

bol.in.bollywood_ishtyle

bol.in.bollywood_ishtyle.amir#$#$#$#E.kya bolti tu?*-*-*-*bol.in.bollywood_ishtyle.hata-ghata#$#$#$#Abe hata sawanki ghata*-*-*-*bol.in.c_ya.maamu#$#$#$#E mamu.baas apun yun gaya aur yun aya*-*-*-*bol.in.bollywood_ishtyle.dharmendra#$#$#$#Maa ka doodh piya hai toh reply de*-*-*-*bol.in.c_ya.apunculti#$#$#$#Apun yahan se kulti marrela hai kya?*-*-*-*bol.in.bollywood_ishtyle.chiranjivi#$#$#$#Bomb potta vedikkum baba sonnale vedikkum*-*-*-*bol.in.bollywood_ishtyle.shaktikapur#$#$#$#Au lolita lets chat baby

/audiblesuburl

/%1.swf

%1.swf

/%1.xml

%1.xml

audibleOnClickMsgLabel_2

audibleOnClickMsgLabel

../../Client/Resources/Images/AvatarDisplay/AvatarLoading.png

../../Client/Resources/Images/AvatarDisplay/AvatarLoadFailed.png

avatars.log

.jpeg

1OnAvatarResponseHeaderReceived(const QHttpResponseHeader&)

1OnAvatarIDResponseHeaderReceived(const QHttpResponseHeader&)

Error: http request failed (%s), user=%s

<key>(.*)</key>

Error: http request failed (%s), avatarId=%s, type=%s

1OnFallbackAvatarIDResponseHeaderReceived(const QHttpResponseHeader&)

1OnFallbackAvatarResponseHeaderReceived(const QHttpResponseHeader&)

http\shell\open\command

18 18 196 2

QtQtQtQtQtQt.#.a.b.cQtQtQtQtQtQtQtQt

QtQtQtQtQtQt.d.e.f.g.hQtQtQtQtQtQtQt

QtQtQtQtQtQt.i.j.k.l.m.nQtQtQtQtQtQt

QtQtQtQtQtQt.o.p.q.r.s.t.u.v.wQtQtQt

QtQtQtQt.I.J.K.L.M.N.O.kQt.kQt.k.P.Q

QtQt.R.S.T.U.V.W.X.Y.Z.0.1.2.k.3.4.5

.6.7.8.9#.###a#b#c#d#e#f#g#h#i#j#kQt

QtQtQtQtQta6a7a8a9b.QtQtQtQtQtQtQtQt

Web Update

GroupExpandedArrow-Normal.png

GroupCollapsedArrow-Normal.png

GroupExpandedArrow-Empty.png

GroupCollapsedArrow-Empty.png

%1 (%2/%3)

scrolltabs_lii.gif

scrolltabs_ld.gif

scrolltabs_rii.gif

scrolltabs_rd.gif

inboxUrl

composeUrl

FileTransfer%d

<meta http-equiv="content-type" content="text/html; charset=x-user-defined">

DIV.SystemMessage

DIV.ChatRoomSystemMessage

DIV.InlinePrompt

DIV#Message SPAN.SelfName

DIV#Message SPAN.PeerName

DIV#Message SPAN.ChatText

SPAN.SmileyAsText

SPAN.SmileyAsImage

.ft11 {FONT-FAMILY: tahoma; FONT-SIZE: 11px;}

.btn1 {FONT-FAMILY: tahoma; FONT-SIZE: 11px;font-weight:bold}

.btn {background: #DDEBF8;border: 1px solid #B1D0ED;font-family:arial;font-size:11px;text-decoration:none;FONT-FAMILY: tahoma; FONT-SIZE: 11px;}

document.charset = "x-user-defined"; // For handling webdunia font quirks

if (document.selection && document.selection.createRange) {

var range = document.selection.createRange();

range.execCommand("Unselect");

var container = document.all.item("MessagesLayer");

//var shouldScroll = (container.scrollHeight < container.clientHeight) || (container.scrollTop   container.clientHeight == container.scrollHeight);

if(container.scrollHeight < container.clientHeight){

if((container.scrollTop   container.clientHeight) <= container.scrollHeight ){

container.insertAdjacentHTML("beforeEnd", html);

if(!scrollBarAppeared && container.scrollHeight > container.clientHeight){

container.scrollTop = container.scrollHeight - container.clientHeight;

document.all.item(id "image").src = imgPath;

document.all.item(id "head").innerHTML = html;

function MoveFTPanelToBottom( id ) {

var container = document.all.item( "MessagesLayer" );

if ( container.scrollHeight < container.clientHeight ) {

if ( (container.scrollTop container.clientHeight) <= container.scrollHeight ) {

container.appendChild( document.all.item("table" id) );

if ( !scrollBarAppeared && (container.scrollHeight>container.clientHeight) ) {

document.all.item(id).innerHTML = html;

document.all.item(id "percent").style.posTop = -33;

document.all.item(id).innerHTML = "";

var html="<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD WIDTH=100% VALIGN=TOP CLASS=ft11><INPUT TYPE='text' name='"   id   "browsefile' style='width:157' class=btn1 value='"   document.all.item(id "path").value   "'> <INPUT TYPE='button' style='width:50' name='browse#"   id   "' value='Browse' class=btn> <INPUT TYPE='button' style='width:50' value='Continue' class=btn name='validate#"   id   "'><br>";

if ( document.all.item(id "check").value == "false" ) {

var html="<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=100%><TR><TD WIDTH=100% VALIGN=TOP CLASS=ft11>This file will be saved in -<br><FONT COLOR='#A79F94'>"   document.all.item(id "browsefile").value   "</FONT><br><TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0 WIDTH=1 HEIGHT=8><TR><TD WIDTH=1 HEIGHT=8></TD></TR></TABLE><INPUT TYPE='button' value='Continue' name='accept#"   id   "' CLASS=btn style='width:65px;height:20px;font-weight:bold'>  <INPUT TYPE='button' value='Change' CLASS=btn style='width:55px;height:20px;' onClick=AcceptFile(\""   id  "\")></TD></TR><INPUT type=hidden name='"   id   "path' value='"   document.all.item(id "browsefile").value   "'/><INPUT type=hidden name='"   id   "check' value="   document.all.item(id "check").checked   " /></TABLE>"

document.all.item('accept#' id).focus();

return document.all.item(id "browsefile").value;

return document.all.item(id "path").value;

return document.all.item(id "check").checked;

document.all.item(id "browsefile").value = path;

var senderNames = document.all.item(senderId);

if (!senderNames.length)

senderNames.innerText = senderName   ": ";

for (i = 0; i < senderNames.length; i  )

senderNames(i).innerText = senderName   ": ";

container.innerHTML = "";

var container = document.all.item("BackgroundLayer");

container.innerHTML = html;

return str.replace(/^\s /g, '').replace(/\s $/g, '');

document.execCommand("SelectAll");

range.execCommand("Copy");

var messages = document.all.item("Message");

if (!messages.length)

return TrimString(messages.innerText)   "\r\n";

for (i = 0; i < messages.length; i  )

text  = TrimString(messages(i).innerText)   "\r\n";

<!--img src="wallpaper.jpg" width="100%" height="100%"-->

<!--img dynsrc="E:/Projects/Rediff-IM/Test/is_your_boss_like_this.mpg" width="100%" height="100%"-->

<!--object style="border: none;" width="100%" height="100%" align="center" border="0" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000">

<param name="movie" value="E:/Projects/Rediff-IM/Client/Components/HtmlChatControl/beach.swf">

<div id=Message><span class="SelfName"></span><span class=chattext>Problem initializing scripting in Internet Explorer. Please make sure that JavaScript is enabled in your browser settings.<br>If you keep experiencing this problem even after you enable scripting, there could be a problem with your browser installation. Please download and install the latest version of 'Windows Script' for your Operating system from <a href="hXXp://msdn.microsoft.com/downloads/list/webdev.asp">hXXp://msdn.microsoft.com/downloads/list/webdev.asp</a> or upgrade to the latest version of Internet Explorer</span></div>

../../Client/Components/HtmlChatControl/HtmlChatControlDoc.html

(((http|https|mailto|ftp|file|rbol|gopher|news|nntp|telnet|wais)://|\bwww\.)(([A-Za-z0-9$_. !*(),;/?:@&~=-])|%[A-Fa-f0-9]{2}) (#([a-zA-Z0-9][a-zA-Z0-9$_. !*(),;/?:@&~=%-]*))?)

<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="48" height="48">

FTSend.png

FTReceive.png

"/><INPUT type=hidden name="Lheck" value=true /></TABLE>

MoveFTPanelToBottom(const QString&)

<object style="border: none;" width="100%" height="100%" align="center" border="0" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000">

{8856f961-340a-11d0-a96b-00c04fd705a2}

{1339b54c-3453-11d2-93b9-000000000000}

1OnResponseHeaderReceived(const QHttpResponseHeader &)

2ResponseHeaderReceived(const QHttpResponseHeader &)

_Regular.png

_Hover.png

_Click.png

_Disabled.png

LangPackInstallerUrl

BoldHotkey

ItalicHotkey

UnderlineHotkey

UnderlineHotkey()

ItalicHotkey()

BoldHotkey()

OnAdResponseHeaderReceived(const QHttpResponseHeader&)

OnHttpFetchFinished

OnHttpFetchFinished(int,bool)

OnFallbackAvatarResponseHeaderReceived(const QHttpResponseHeader&)

OnAvatarResponseHeaderReceived(const QHttpResponseHeader&)

OnFallbackAvatarIDResponseHeaderReceived(const QHttpResponseHeader&)

OnAvatarIDResponseHeaderReceived(const QHttpResponseHeader&)

keyboardFocusTab

SetUrl

SetUrl(const QString&)

HttpFetcher

ResponseHeaderReceived(const QHttpResponseHeader&)

HttpFetcherImpl

ProxyAuthHttpFetcher

OnHTTPSSocketConnected

OnHTTPSSocketConnectionClosed

OnHTTPSSocketReadyRead

OnHTTPSSocketBytesWritten

OnHTTPSSocketError

redQHttpId

OnHTTPSSocketError(int)

OnHTTPSSocketBytesWritten(int)

OnHTTPSSocketReadyRead()

OnHTTPSSocketConnectionClosed()

OnHTTPSSocketConnected()

onDoubleClickMsg

UDPAppletInterfaceManager

UrlsUpdateCheckCompleted

UrlsUpdateCheckCompleted(bool,const QString&,const QString&,int)

contentUrl

OnUrlsUpdateCheckCompleted

OnUrlsUpdateDownloadCompleted

OnUrlsUpdateDownloadCompleted(bool)

OnUrlsUpdateCheckCompleted(bool,const QString&,const QString&,int)

WelcomeUrlAvailable

WelcomeUrlAvailable(const QString&,int,int)

MailAlert.png

../../Client/Resources/Images/NotifyWindow/MailAlert.png

2responseHeaderReceived(const QHttpResponseHeader &)

192.168.1.50

203.199.37.139

HTTPS Proxy

1OnHTTPSSocketConnectionClosed()

1OnHTTPSSocketBytesWritten(int)

1OnHTTPSSocketError(int)

1OnHTTPSSocketConnected()

1OnHTTPSSocketReadyRead()

ProxyAuthHttpFetcher::OnSocks5SocketReadyRead

response.size :

OnHTTPSSocketConnected

HTTP/1.1

ProxyAuthHttpFetcher::OnHTTPSSocketConnected

OnHTTPSSocketConnectionClosed

OnHTTPSSocketReadyRead

OnHTTPSSocketBytesWritten

OnHTTPSSocketError :

HTTP/1.0

ProxyAuthHttpFetcher::OnNTLMSocketConnected

ProxyAuthHttpFetcher::OnNTLMSocketReadyRead

Adding to pending request queue without making a QHttp request :

%1_Disabled.png

%1_Regular.png

%1_Hover.png

%1_Click.png

QuillWebLoading.html

Started tcp bridge over listening address :

VNC_SERVER_PORT=

TachyonWinVNC.exe

TachyonVNCViewer.exe

scroll_ln.gif

scroll_ld.gif

scroll_rn.gif

scroll_rd.gif

star.gif

_R%X@

.Kjd`

angel.gif static/angel_static.gif Angel 0:) O:)

angry.gif static/angry_static.gif Angry (X) >:(

brokenheart.gif static/brokenheart_static.gif Broken Heart (B)

confused.gif static/confused_static.gif Confused :-S :s

cry.gif static/cry_static.gif Cry (C) :`(

devil.gif static/devil_static.gif Devil (D) >:|

donttellanyone.gif static/donttellanyone_static.gif Don't Tell Anyone :-*

embarrassed.gif static/embarrassed_static.gif Embarrassed (E) :$ :-$

eyerolling.gif static/eyerolling_static.gif Roll Eyes 8-) 8-|

hot.gif static/hot_static.gif Hot (H) #:)

idontknow.gif static/idontknow_static.gif I don't know (K) :^)

laugh.gif static/laugh_static.gif Laugh :D

sad.gif static/sad_static.gif Sad (S) :( :-(

sarcastic.gif static/sarcastic_static.gif Sarcastic (R) ^O) ^o)

sick.gif static/sick_static.gif Sick :((

sleepy.gif static/sleepy_static.gif Sleepy :Z :z

smile.gif static/smile_static.gif Smile :) :-)

surprised.gif static/surprised_static.gif Surprised :O :-O

thinking.gif static/thinking_static.gif Thinking (T) \:)

tongueout.gif static/tongueout_static.gif Tongue out :-P :p

wink.gif static/wink_static.gif Wink ;) ;-)

./angel.gif

./angry.gif

./brokenheart.gif

./confused.gif

./cry.gif

./devil.gif

./donttellanyone.gif

./embarrassed.gif

./eyerolling.gif

./hot.gif

./idontknow.gif

./laugh.gif

./sad.gif

./sarcastic.gif

./sick.gif

./sleepy.gif

./smile.gif

./surprised.gif

./thinking.gif

./tongueout.gif

./wink.gif

./SmileyCodes.txt

127.0.0.1

UDPListenPortForApplets

STATUSMSG

WhatsNewUrl

urls

../../Client/Resources/Audibles/audiblemenu.xml

1OnUrlsUpdateCheckCompleted(bool,const QString &,const QString &,int)

2UrlsUpdateCheckCompleted(bool,const QString &,const QString &,int)

smsJokes.xml

1OnUrlsUpdateDownloadCompleted(bool)

smsjoke.html

AvatarLoading.png

AvatarLoadFailed.png

AvatarNotSet.png

769c0340-71b8-472f-9057-ed881688c4f0

cacde0ae-c5ce-4f89-8836-ce91731dcbdc

75499534-d9da-41cf-978e-4df217193aa6

68bcae3f-651c-49ad-b874-93950190480b

c51ff693-d913-4b68-9a64-295dd8c2bf44

9e1d79ae-f0a2-4176-be9c-fd9bc787e318

ConvertUnicodeToWebd(const QString&)

ConvertWebdToUnicode(const QString&)

{.OrI

 .WOx|

EQ.NiZ

Cw'.qZ

|sQl%

Z5V.GC

{.bl43_

A.rr~z6

Lq%3xnf

A.Oj[

T9?%S

3,&t,%s

.Wf{|#i

9xAway.png

9xBlocked.png

9xBusy.png

9xOffline.png

9xOnMobile.png

9xMobileBuddy.png

9xOfflineBlocked.png

9xNonBolContact.png

SignIn_Click.png

SignIn_Disabled.png

SignIn_Hover.png

SignIn_Regular.png

SignInPreLogin_Click.png

SignInPreLogin_Disabled.png

SignInPreLogin_Hover.png

SignInPreLogin_Regular.png

Cancel_Click.png

Cancel_Disabled.png

Cancel_Hover.png

Cancel_Regular.png

CancelSignIn_Click.png

CancelSignIn_Disabled.png

CancelSignIn_Hover.png

CancelSignIn_Regular.png

Register_Click.png

Register_Disabled.png

Register_Hover.png

Register_Regular.png

MWAdd_Click.png

MWAdd_Disabled.png

MWAdd_Hover.png

MWAdd_Regular.png

MWEmail_Disabled.png

MWEmail_Regular.png

MWEmail_Hover.png

MWEmail_Click.png

MWChat_Click.png

MWChat_Disabled.png

MWChat_Hover.png

MWChat_Regular.png

MWIM_Click.png

MWIM_Disabled.png

MWIM_Hover.png

MWIM_Regular.png

MWSMS_Click.png

MWSMS_Disabled.png

MWSMS_Hover.png

MWSMS_Regular.png

MWTalkSee_Click.png

MWTalkSee_Disabled.png

MWTalkSee_Hover.png

MWTalkSee_Regular.png

MWOnlineSort_Click.png

MWOnlineSort_Disabled.png

MWOnlineSort_Hover.png

MWOnlineSort_Regular.png

MWMobileSort_Click.png

MWMobileSort_Disabled.png

MWMobileSort_Hover.png

MWMobileSort_Regular.png

MWChangeStatus_Click.png

MWChangeStatus_Disabled.png

MWChangeStatus_Hover.png

MWChangeStatus_Regular.png

InviteFriend_Click.png

InviteFriend_Disabled.png

InviteFriend_Hover.png

InviteFriend_Regular.png

SendFile_Click.png

SendFile_Disabled.png

SendFile_Hover.png

SendFile_Regular.png

Send_Click.png

Send_Disabled.png

Send_Hover.png

Send_Regular.png

Smiley_Click.png

Smiley_Disabled.png

Smiley_Hover.png

Smiley_Regular.png

Font_Click.png

Font_Disabled.png

Font_Hover.png

Font_Regular.png

QuickReply_Click.png

QuickReply_Disabled.png

QuickReply_Hover.png

QuickReply_Regular.png

TalkSee_Click.png

TalkSee_Disabled.png

TalkSee_Hover.png

TalkSee_Regular.png

Shock_Click.png

Shock_Disabled.png

Shock_Hover.png

Shock_Regular.png

EndCall_Click.png

EndCall_Disabled.png

EndCall_Hover.png

EndCall_Regular.png

SMS_Click.png

SMS_Disabled.png

SMS_Hover.png

SMS_Regular.png

Conference_Click.png

Conference_Disabled.png

Conference_Hover.png

Conference_Regular.png

BuddyProfileLeft_Click.png

BuddyProfileLeft_Disabled.png

BuddyProfileLeft_Hover.png

BuddyProfileLeft_Regular.png

BuddyProfileRight_Click.png

BuddyProfileRight_Disabled.png

BuddyProfileRight_Hover.png

BuddyProfileRight_Regular.png

Talkies_Click.png

Talkies_Disabled.png

Talkies_Hover.png

Talkies_Regular.png

IgnoreUser_Click.png

IgnoreUser_Disabled.png

IgnoreUser_Hover.png

IgnoreUser_Regular.png

AllowUser_Click.png

AllowUser_Disabled.png

AllowUser_Hover.png

AllowUser_Regular.png

AddAsFriend_Click.png

AddAsFriend_Disabled.png

AddAsFriend_Hover.png

AddAsFriend_Regular.png

ShowAvatar_Click.png

ShowAvatar_Disabled.png

ShowAvatar_Hover.png

ShowAvatar_Regular.png

HideAvatar_Click.png

HideAvatar_Disabled.png

HideAvatar_Hover.png

HideAvatar_Regular.png

IM_Click.png

IM_Disabled.png

IM_Hover.png

IM_Regular.png

ChangeAvatar_Click.png

ChangeAvatar_Disabled.png

ChangeAvatar_Hover.png

ChangeAvatar_Regular.png

TalkIcon_Click.png

TalkIcon_Disabled.png

TalkIcon_Hover.png

TalkIcon_Regular.png

MailOpen_Click.png

MailOpen_Disabled.png

MailOpen_Hover.png

MailOpen_Regular.png

SettingsIcon_Click.png

SettingsIcon_Disabled.png

SettingsIcon_Hover.png

SettingsIcon_Regular.png

MailReply_Click.png

MailReply_Disabled.png

MailReply_Hover.png

MailReply_Regular.png

MailReplyAll_Click.png

MailReplyAll_Disabled.png

MailReplyAll_Hover.png

MailReplyAll_Regular.png

MailForward_Click.png

MailForward_Disabled.png

MailForward_Hover.png

MailForward_Regular.png

MailDelete_Click.png

MailDelete_Disabled.png

MailDelete_Hover.png

MailDelete_Regular.png

Accept_Click.png

Accept_Disabled.png

Accept_Hover.png

Accept_Regular.png

Block_Click.png

Block_Disabled.png

Block_Hover.png

Block_Regular.png

Ignore_Click.png

Ignore_Disabled.png

Ignore_Hover.png

Ignore_Regular.png

CloseTab_Click.png

CloseTab_Disabled.png

CloseTab_Hover.png

CloseTab_Regular.png

Untab_Click.png

Untab_Disabled.png

Untab_Hover.png

Untab_Regular.png

'StartAudioResponse', starting to send firewall probes, remoteAddr = %s

'DoAudioProbe', starting to send firewall probes in reverse direction, remoteAddr = %s

'UseAudioRouter', probing aborted, using router, going to ACTIVE. routerAddr = %s

'OnCreateAudioRouterResponse', router created, going to ACTIVE. routerAddr = %s

audioport.cfg

'CreateLocalSocket', localAddr = %s

msgDisplayFrame

msgDisplayFrameLayout

msgDisplayLabel

InviteUserDialogClientArea::setCanLogin(): Not implemented yet

InviteUserDialogClientArea::setNickNameState(): Not implemented yet

Video\Talk&See.exe

video.log

PORT=

LOGIN_SUCCESS

LOGIN_FAILURE

hXXp://VVV.rediff.com

LanguageOptions.txt

QuillUnicodeWebUrl

QuillWebUrl

QuillWeb

GetOfflineMsgs

AutoJoinChatRoom

JoinChatRoom

DelOfflineMsg

\Projects\Rediff-IM\Interfaces\Rbol1.2\Client2Server\IServer1_2_relaynitro.cpp

JoinConference

::RBOL1_2::JoinChatRoomException

\Projects\Rediff-IM\Interfaces\Rbol1.2\Client2Client\IClientPeer1_2_asyncnitro.cpp

AddImportedContact

\Projects\Rediff-IM\Interfaces\Rbol1.2\Server2Client\IClient1_2_relaynitro.cpp

UserJoined

ParticipantJoinedChatRoom

NickNameUpdate

\Projects\Rediff-IM\Interfaces\Rbol1.2\Client2Client\IClientPeer1_2_relaynitro.cpp

GetLoginServers

\Projects\Rediff-IM\Interfaces\Gatekeeper\IGatekeeper2_relaynitro.cpp

\Projects\Rediff-IM\Interfaces\Rbol1.2\Common\Structs1_2_nitro.cpp

\Projects\Rediff-IM\Interfaces\Rbol1.2\Client2Server\IServer1_2_nitro.cpp

\Projects\Rediff-IM\Interfaces\Gatekeeper\IGatekeeper2_nitro.cpp

ACE_LOG_MSG_INSTANCE_LOCK

ACE_LOG_MSG_INSTANCE_LOCK

ace/OS.cpp, line %u: %s

ACE_OS::socket_init; WSAStartup failed, WSAGetLastError returned %d

ACE_OS::socket_fini; WSACleanup failed, WSAGetLastError returned %d

.\Recursive_Thread_Mutex.cpp

%3s %3s - d d:d:d.d

version of WinSock not supported

app version not supported by DLL

Blocking operation in progress

address family not supported

specified protocol not supported

socket type not supported for address family

unknown error: %d

.\Thread_Mutex.cpp

.\Mutex.cpp

(%P|%t|%x)

.\Framework_Component.cpp

AFR::remove_dll_components_i (%s) component "%s"

.\Service_Config.cpp

%c is not a ACE_Service_Config option

opening static service %s

%s not found

opening dynamic service %s

dynamic initialization failed for %s

Service_Config::process_directive - %s

.\svc.conf

beginning reconfiguration at %s

s: %s

signal %d

HEXDUMP %u bytes

(showing first %u bytes)

.\Message_Block.cpp

.\RW_Mutex.cpp

.\Condition_Thread_Mutex.cpp

ACE_Thread::keycreate() failed!

..\ace/TSS_T.cpp

.\DLL_Manager.cpp

ACE_DLL_Handle::open: error, tried to reopen %s with name %s

ACE_DLL_Handle::open: calling dlopen on "%s"

ACE_DLL_Handle::open: Invalid handle when opening DLL %s: %s

ACE_DLL_Handle::open: loading %s (%d)

ACE_DLL_Handle::close: unloading %s (%d)

ACE_DLL_Handle::close error: "%s".

ACE_DLL_Handle::symbol ("%s") "%s".

ACE_DLL_Handle::get_handle: post call: handle %s, refcount %d

ACE_DLL_Manager::open_dll: Could not open dll %s.

%d/%s %s

.\Service_Manager.cpp

len = %d, info = %s%s

client_stream fd = %d

accepted from host %s at port %d

..\ace/Message_Queue_T.cpp

.\Service_Repository.cpp

finalizing %s

.\Service_Types.cpp

destroying %s, flags = %d

..\ace/Module.cpp

.\ARGV.cpp

.\Svc_Conf_y.cpp

dynamic initialization failed for Module %s

cannot remove Module_Type %s from STREAM_Type %s

Unable to find service: %s

[error %d] on line %d: %s

cannot locate Module_Type %s in STREAM_Type %s

cannot locate Module_Type %s or STREAM_Type %s

warning: assigning Module_Type name %s to Module %s since names differ

.\DLL.cpp

ACE_DLL::copy_ctor: error: %s

ACE_DLL::open: error calling open: %s

ACE_DLL::open_i: dll_name: %s

.\Svc_Conf_l.cpp

unknown character = (%d

.\Get_Opt.cpp

%s: option `%s' is ambiguous

%s: long option `--%s' doesn't allow an argument

%s: long option '--%s' requires an argument

%s: illegal long option '--%s'

%s: illegal short option -- %c

%s: short option requires an argument -- %c

Existing short option '%c' takes optional argument; adding %s requires ARG_OPTIONAL

Existing short option '%c' requires an argument; adding %s requires ARG_REQUIRED

Existing short option '%c' does not accept an argument; adding %s requires NO_ARG

TypesSupported

%s.ld %s

%s@%s@%u@%s@%s

%s@%s@%s

.\Lib_Find.cpp

Warning: improper suffix for a shared library on this platform: %s

%s%s%s

%s%s%s%s

.\SOCK_Acceptor.cpp

%s:%d

.\INET_Addr.cpp

.\SOCK.cpp

.\WFMO_Reactor.cpp

%d exceeds MAXIMUM_WAIT_OBJECTS (%d)

invalid mask = %d

.\Parse_Node.cpp

did stream on %s, error = %d

svc = %s

did suspend on %s, error = %d

did resume on %s, error = %d

did remove on %s, error = %d

did dynamic on %s, error = %d

did static on %s, error = %d

no error reported

ACE_DLL::open failed for %s: %s

ACE_DLL::symbol failed for object %s: %s

ACE_DLL::symbol failed for function %s: %s

did operations on stream %s, error = %d

no static service registered for function %s

.\SOCK_Connector.cpp

%d.%d.%d.%d

255.255.255.255

.\Event.cpp

select failed with %d

notifyReadHandle read failed with %d

E:\Libraries\Networking\ACE-5.4.2\ace/Condition_T.cpp

ThreadPool: Initiated taskHandler-%d

\Projects\Nitro\Src\NitroUtil\MarshalBuffer.cpp

%s %s

LastError = (%ul) %s

] Exception inside SwitchBoard::ExecuteRequest() object =

Nitro::Transport::OnRequest

Nitro::Transport::OnResponse

Nitro::Transport::OnException

] Exception inside RequestCallback::ExecuteOneWay() object =

Nitro::Transport::OnOneWay

\Projects\Nitro\Src\Nitro\Transports\TCPTransport.cpp

\Projects\Nitro\Src\Nitro\Stub.cpp

\Projects\Nitro\Src\Nitro\Transports\TCPTransportBase.cpp

\Projects\Nitro\Src\Nitro\Transports\TwoWayTransportBase.cpp

\Projects\Nitro\Src\NTunnel\TunnelingTransport\TunnelingClientTransport.cpp

/poll.cgi

NTunnel::TunnelingClientTransport::HandleReadEvent

%s] Error reading messagescount : (%d) %s

\Projects\Nitro\Src\NTunnel\TunnelingTransport\TunnelingNTLMClientTransport.cpp

NTunnel::TunnelingNTLMClientTransport::HandleReadEvent

/direct.cgi

%c%c==

%c%c%c=

%c%c%c%c

NTLMSSP%c

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%s%s

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c

%s:%s

Basic %s

NTLM %s

HTTP/

HTTP/

QAxBase: Error calling IDispatch member %s: Unknown error.

QAxBase: Error calling IDispatch member %s: Non-optional parameter missing.

QAxBase: Error calling IDispatch member %s: Unknown locale ID.

QAxBase: Error calling IDispatch member %s: Unknown interface.

QAxBase: Error calling IDispatch member %s: Type mismatch in parameter %d.

QAxBase: Error calling IDispatch member %s: Parameter %d not found.

QAxBase: Error calling IDispatch member %s: Overflow.

QAxBase: Error calling IDispatch member %s: No named arguments.

QAxBase: Error calling IDispatch member %s: Member not found.

QAxBase: Error calling IDispatch member %s: Exception thrown by server.

QAxBase: Error calling IDispatch member %s: Bad variant type.

QAxBase: Error calling IDispatch member %s: Bad parameter count.

Did you mean %s?

QAxBase::internalInvoke: %s: No such method or property in %s [%s]

QAxBase::querySubObject: %s: error calling function or property in %s (%s)

QAxBase::querySubObject: %s: method or property is not of interface type in %s (%s)

%1$%2$%3

ASSERT: "%s" in %s (%d)

.\qaxbase.cpp

.\qaxwidget.cpp

QUObjectToVARIANT: Unhandled QUType %s!

.\Pipe.cpp

ACE_Pipe::ACE_Pipe

.\UUID.cpp

%8x-%4x-%4x-%2x%2x-%2x%2x%2x%2x%2x%2x

%8x-%4x-%4x-%2x%2x-%2x%2x%2x%2x%2x%2x-%s

ACE_UUID_Impl::ACE_UUID_Impl - IllegalArgument(unsupported variant)

ACE_UUID::ACE_UUID - IllegalArgument(unsupported version)

%8.8x-%4.4x-%4.4x-%2.2x%2.2x-%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x-%s-%s

 H %d

.\Process.cpp

%s=%s

.\SOCK_Dgram.cpp

\Projects\Nitro\Src\Nitro\Transports\MessageQueue.cpp

333?333?

&"( . : 

.HTeu{{j

e:\Projects\Rediff-IM\_Output_\RediffMessenger-VC71-MT.pdb

URLDownloadToFileA

urlmon.dll

KERNEL32.dll

USER32.dll

GDI32.dll

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

ShellExecuteExA

SHELL32.dll

ole32.dll

MSVCP71.dll

MSVCR71.dll

_acmdln

_amsg_exit

WININET.dll

?cmd@QPaintDevice@@MAE_NHPAVQPainter@@PATQPDevCmdParam@@@Z

A2?setKeyCompression@QWidget@@MAEX_N@Z

T!?keyReleaseEvent@QWidget@@MAEXPAVQKeyEvent@@@Z

P!?keyPressEvent@QWidget@@MAEXPAVQKeyEvent@@@Z

<?winEvent@QWidget@@MAE_NPAUtagMSG@@@Z

<?winEventFilter@QApplication@@UAE_NPAUtagMSG@@@Z

?exec@QApplication@@QAEHXZ

<?winVersion@QApplication@@SA?AW4WindowsVersion@Qt@@XZ

?exec@QDialog@@QAEHXZ

9!?key@QListViewItem@@UBE?AVQString@@H_N@Z

@!?keyPressEvent@QDialog@@MAEXPAVQKeyEvent@@@Z

?exec@QPopupMenu@@QAEHABVQPoint@@H@Z

I!?keyPressEvent@QPopupMenu@@MAEXPAVQKeyEvent@@@Z

/?setAccel@QAction@@UAEXABVQKeySequence@@@Z

??1QKeySequence@@QAE@XZ

??0QKeySequence@@QAE@H@Z

??0QKeyEvent@@QAE@W4Type@QEvent@@HHHABVQString@@_NG@Z

??1QKeyEvent@@UAE@XZ

<?viewport@QScrollView@@QBEPAVQWidget@@XZ

??0QKeySequence@@QAE@ABVQString@@@Z

?insertItem@QMenuData@@QAEHABVQString@@PBVQObject@@PBDABVQKeySequence@@HH@Z

/?setAccel@QButton@@UAEXABVQKeySequence@@@Z

R!?keyReleaseEvent@QButton@@MAEXPAVQKeyEvent@@@Z

=!?keyPressEvent@QButton@@MAEXPAVQKeyEvent@@@Z

D!?keyPressEvent@QLineEdit@@MAEXPAVQKeyEvent@@@Z

H!?keyPressEvent@QMessageBox@@MAEXPAVQKeyEvent@@@Z

G!?keyPressEvent@QMenuBar@@MAEXPAVQKeyEvent@@@Z

k7?statusCode@QHttpResponseHeader@@QBEHXZ

L!?keyPressEvent@QTabBar@@MAEXPAVQKeyEvent@@@Z

>!?keyPressEvent@QComboBox@@MAEXPAVQKeyEvent@@@Z

/?setAllColumnsShowFocus@QListView@@UAEX_N@Z

<?viewportContextMenuEvent@QScrollView@@MAEXPAVQContextMenuEvent@@@Z

(<?viewportWheelEvent@QScrollView@@MAEXPAVQWheelEvent@@@Z

<?viewportDropEvent@QScrollView@@MAEXPAVQDropEvent@@@Z

<?viewportDragLeaveEvent@QScrollView@@MAEXPAVQDragLeaveEvent@@@Z

<?viewportDragMoveEvent@QScrollView@@MAEXPAVQDragMoveEvent@@@Z

<?viewportDragEnterEvent@QScrollView@@MAEXPAVQDragEnterEvent@@@Z

<?viewportMouseMoveEvent@QScrollView@@MAEXPAVQMouseEvent@@@Z

<?viewportMouseDoubleClickEvent@QScrollView@@MAEXPAVQMouseEvent@@@Z

<?viewportMouseReleaseEvent@QScrollView@@MAEXPAVQMouseEvent@@@Z

<?viewportMousePressEvent@QScrollView@@MAEXPAVQMouseEvent@@@Z

<?viewportResizeEvent@QListView@@MAEXPAVQResizeEvent@@@Z

<?viewportPaintEvent@QScrollView@@MAEXPAVQPaintEvent@@@Z

F!?keyPressEvent@QListView@@MAEXPAVQKeyEvent@@@Z

<?viewportResizeEvent@QScrollView@@MAEXPAVQResizeEvent@@@Z

<?viewportPaintEvent@QListBox@@UAEXPAVQPaintEvent@@@Z

E!?keyPressEvent@QListBox@@MAEXPAVQKeyEvent@@@Z

?doKeyboardAction@QTextEdit@@UAEXW4KeyboardAction@1@@Z

"<?viewportResizeEvent@QTextEdit@@MAEXPAVQResizeEvent@@@Z

O!?keyPressEvent@QTextEdit@@MAEXPAVQKeyEvent@@@Z

??0QWindowsMime@@QAE@XZ

?contentsToViewport@QScrollView@@QBEXHHAAH0@Z

?contentsToViewport@QScrollView@@QBE?AVQPoint@@ABV2@@Z

{8?text@QKeyEvent@@QBE?AVQString@@XZ

??1QWindowsMime@@UAE@XZ

N!?keyPressEvent@QTextBrowser@@MAEXPAVQKeyEvent@@@Z

??1QUrl@@UAE@XZ

&?path@QUrl@@QBE?AVQString@@_N@Z

?host@QUrl@@QBE?AVQString@@XZ

??0QUrl@@QAE@ABVQString@@@Z

?contentType@QHttpHeader@@QBE?AVQString@@XZ

?insertItem@QAccel@@QAEHABVQKeySequence@@H@Z

??BQKeySequence@@QBEHXZ

Z5?shortcutKey@QAccel@@SA?AVQKeySequence@@ABVQString@@@Z

-!?join@QStringList@@QBE?AVQString@@ABV2@@Z

??0QGDict@@IAE@IW4KeyType@0@_N1@Z

?errorString@QHttp@@QBE?AVQString@@XZ

,?readAll@QHttp@@QAE?AV?$QMemArray@D@@XZ

?abort@QHttp@@QAEXXZ

??1QHttpRequestHeader@@UAE@XZ

??0QHttpRequestHeader@@QAE@ABV0@@Z

??0QHttpRequestHeader@@QAE@XZ

?currentId@QHttp@@QBEHXZ

;?value@QHttpHeader@@QBE?AVQString@@ABV2@@Z

??4QHttpRequestHeader@@QAEAAV0@ABV0@@Z

?currentRequest@QHttp@@QBE?AVQHttpRequestHeader@@XZ

-?request@QHttp@@QAEHABVQHttpRequestHeader@@PAVQIODevice@@1@Z

4?setValue@QHttpHeader@@QAEXABVQString@@0@Z

??0QHttpRequestHeader@@QAE@ABVQString@@0HH@Z

?disconnectSignalSlotConnections@QHttp@@QAEXXZ

?checkConnection@QNetworkProtocol@@MAE_NPAVQNetworkOperation@@@Z

%?operationPutChunk@QNetworkProtocol@@MAEXPAVQNetworkOperation@@@Z

%?operationPut@QHttp@@MAEXPAVQNetworkOperation@@@Z

%?operationGet@QHttp@@MAEXPAVQNetworkOperation@@@Z

%?operationRename@QNetworkProtocol@@MAEXPAVQNetworkOperation@@@Z

%?operationRemove@QNetworkProtocol@@MAEXPAVQNetworkOperation@@@Z

%?operationMkDir@QNetworkProtocol@@MAEXPAVQNetworkOperation@@@Z

%?operationListChildren@QNetworkProtocol@@MAEXPAVQNetworkOperation@@@Z

'?processOperation@QNetworkProtocol@@MAEXPAVQNetworkOperation@@@Z

?clearOperationQueue@QNetworkProtocol@@UAEXXZ

?addOperation@QNetworkProtocol@@UAEXPAVQNetworkOperation@@@Z

7?supportedOperations@QHttp@@UBEHXZ

4?setUrl@QNetworkProtocol@@UAEXPAVQUrlOperator@@@Z

8?timerEvent@QHttp@@MAEXPAVQTimerEvent@@@Z

*?qt_property@QHttp@@UAE_NHHPAVQVariant@@@Z

)?qt_emit@QHttp@@UAE_NHPAUQUObject@@@Z

K*?qt_invoke@QHttp@@UAE_NHPAUQUObject@@@Z

-)?qt_cast@QHttp@@UAEPAXPBD@Z

?className@QHttp@@UBEPBDXZ

#?metaObject@QHttp@@UBEPAVQMetaObject@@XZ

?initSignalSlotConnections@QHttp@@QAEXXZ

?getSocket@QHttp@@QAEPAVQSocket@@XZ

??0QHttp@@QAE@ABVQString@@GPAVQObject@@PBD@Z

??1QHttp@@UAE@XZ

$?msg_index@QGArray@@CAXI@Z

&<?viewportToContents@QScrollView@@QBE?AVQPoint@@ABV2@@Z

Qt-VC71-MT.dll

WINMM.dll

GetKeyState

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExW

RegCreateKeyA

ReportEventA

OLEAUT32.dll

WS2_32.dll

NETAPI32.dll

?getKeyString@QGDictIterator@@QBE?AVQString@@XZ

7?subkeyList@QSettings@@QBE?AVQStringList@@ABVQString@@@Z

/?setAccel@QMenuData@@QAEXABVQKeySequence@@H@Z

??4QKeySequence@@QAEAAV0@ABV0@@Z

??0QKeySequence@@QAE@XZ

DSOUND.dll

.?AVClosableTransportCallback@Nitro@@

.?AVTunnelingClientTransport@NTunnel@@

.?AVTransport@Nitro@@

.?AVTCPTransport@Nitro@@

.?AVPortNoValidator@@

.?AVQKeyEvent@@

.?AVLoginForm@@

.?AVNickNameUpdateForm@@

.?AVOfflineMsgDialog@@

.?AVLoginFormClientArea@@

.?AVNickNameUpdateFormClientArea@@

.?AVOfflineMsgDialogClientArea@@

.?AVQWindowsMime@@

.?AVActiveTextWindowsMime@@

.?AVHttpFetcher@@

.?AVHttpFetcherImpl@@

.?AVProxyAuthHttpFetcher@@

.?AVQHttp@@

.?AVSimpleHttpFetcher@@

.?AVTCPBridge@@

.?AVUDPAppletInterfaceMsg@@

.?AVUDPAppletInterfaceManager@@

.?AVWebDuniaConverter@@

.?AVVideoHandlerMsg@@

.?AVJoinChatRoomException@RBOL1_2@@

.?AVACE_Log_Msg_Backend@@

.?AVACE_Log_Msg_IPC@@

.?AVACE_Log_Msg_NT_Event_Log@@

.?AUInvokeMsg@RelayAgent@Nitro@@

.?AVASyncDispatchTransportBase@Nitro@@

.?AVTwoWayTransportBase@Nitro@@

.?AVTCPTransportBase@Nitro@@

.?AUResultMsg@RelayStub@Nitro@@

.?AVTCPInContext@Nitro@@

.?AVTunnelingNTLMClientTransport@NTunnel@@

.?AVTunnelingClientTransportInContext@NTunnel@@

.?AVTunnelingNTLMClientTransportInContext@NTunnel@@

libdes part of OpenSSL 0.9.7d 17 Mar 2004

DES part of OpenSSL 0.9.7d 17 Mar 2004

Sample format not supported

Internal PortAudio Error.

DirectSound ReadBlock failed, hresult = 0x%x

DirectSound WriteBlock failed, result = 0x%x

PortAudio on DirectSound - Latency = %d frames, %d msec

Creation of requested Audio Output device '%s' failed.

Using device '%s' instead.

PortAudio: DirectSoundCreate() failed!

Creation of requested Audio Capture device '%s' failed.

Try device '%s' instead.

PortAudio: DirectSoundCaptureCreate() failed!

PortAudio: DSW_InitInputBuffer() returns %x

speex-1.1.11.1

Fatal error: %s

warning: %s

warning: %s %d

A, ,,.SS3a~LSSSSSSTX

[,   .STSLb}

,   .STTT3

p,  .STTT4

, .TTTTP

31336331

'31335331$

#31336333#

31336331

'133633$

%%SPPVSP/

|||......EEE

......OOO

......sss

' $#"'('!

/.*.-/0/

575606787

_]^]^_`_

Copyright (C) 2005, Rediff.com India Ltd.

8.0.0.315

Rediff.com India Ltd.

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   RediffMessenger.exe:1880
   %original file name%.exe:2304
   

2. Delete the original Malware file.
   
3. Delete or disinfect the following files created/modified by the Malware:
   

   C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 (1168 bytes)
   C:\Windows\System32\config\SYSTEM (1336 bytes)
   C:\Boot\BCD.LOG (1768 bytes)
   C:\Windows\System32\config\SOFTWARE (69394 bytes)
   C:\Windows\System32\config\DEFAULT.LOG1 (5208 bytes)
   C:\Windows\System32\config\SECURITY.LOG1 (1048 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\UsrClass.dat (5640 bytes)
   C:\System Volume Information\Syscache.hve (16624 bytes)
   C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 (1168 bytes)
   C:\Users\"%CurrentUserName%"\NTUSER.DAT (20464 bytes)
   C:\System Volume Information\Syscache.hve.LOG1 (9576 bytes)
   C:\Windows\System32\config\SYSTEM.LOG1 (1779 bytes)
   C:\Users\"%CurrentUserName%"\ntuser.dat.LOG1 (18688 bytes)
   C:\$Directory (880 bytes)
   C:\Windows\System32\config\SOFTWARE.LOG1 (74546 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 (4768 bytes)
   %Program Files% (x86)\Rediff Bol\redifftoolbar.xpi (4992 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\laugh_static.gif (282 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Regular.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_ln.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Disabled.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Regular.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\smile.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\confused_static.gif (257 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Hover.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\devil.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Hover.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\RediffToolbar.exe (21246 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Regular.png (991 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\bol.in.bollywood_ishtyle.xml (854 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\Alert.wav (8 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\chimedwn.wav (5 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\SmileyCodes.txt (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\StatusAlert.png (738 bytes)
   %Program Files% (x86)\Rediff Bol\RDTelConv.dll (3722 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\ioSpecial.ini (9733 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\QuillWebLoading.html (173 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\brokenheart_static.gif (301 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sarcastic_static.gif (250 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Hover.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\grey.swf (77 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh934.tmp (290478 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\RINGIN.WAV (784 bytes)
   %Program Files% (x86)\Rediff Bol\Qt-VC71-MT.dll (135026 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\wink.gif (558 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Rediff Bol 8.0 Messenger.lnk (908 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\MessageAlert.wav (1856 bytes)
   C:\Windows\Fonts\Shree502.ttf (1856 bytes)
   %Program Files% (x86)\Rediff Bol\uninstall.exe (2163 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Click.png (627 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\tongueout.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\embarrassed_static.gif (240 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\brokenheart.gif (2 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rediff Bol\Uninstall.lnk (1 bytes)
   %Program Files% (x86)\Rediff Bol\RDHinConv.dll (3398 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\bol.in.c_ya.xml (226 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Disabled.png (545 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\devil_static.gif (245 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\RINGOUT.WAV (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\Flash[1].ocx (102659 bytes)
   %Program Files% (x86)\Rediff Bol\RDMalConv.dll (2461 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\urls.xml (2 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Regular.png (776 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\WizardResults\Sad.png (690 bytes)
   %Program Files% (x86)\Rediff Bol\RDKanConv.dll (3402 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Click.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\RediffMessenger.exe (102654 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\donttellanyone.gif (297 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Regular.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_rd.gif (220 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Click.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Regular.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\RDTamConv.dll (1921 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\phone.wav (784 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\wink_static.gif (235 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_lii.gif (406 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Misc\FTSend.png (2 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\star.gif (541 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Disabled.png (825 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Disabled.png (1 bytes)
   C:\Windows\Fonts\Shree853.ttf (1856 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\eyerolling.gif (573 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\DefaultAd.html (841 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\AvatarDisplay\AvatarLoadFailed.png (3 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Misc\FTReceive.png (2 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sarcastic.gif (252 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Regular.png (756 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\Closecall.wav (4 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailAlert.png (828 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\confused.gif (259 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\RingingTone-Old.wav (784 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sleepy.gif (3 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\smsJokes.xml (53 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\offline.wav (9 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sad.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\AvatarDisplay\AvatarNotSet.png (5 bytes)
   C:\Windows\Fonts\Shree900.ttf (1856 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_rn.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\online.wav (11 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\QuickReplies.txt (204 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Click.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\userstatus.xml (294 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Hover.png (610 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailForward_Disabled.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Click.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Click.png (792 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\smsJokes.html (69 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\angry_static.gif (241 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\laugh.gif (3 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_rd.gif (388 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Regular.png (1 bytes)
   C:\Windows\Fonts\Barani.ttf (2392 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\loading.swf (910 bytes)
   %Program Files% (x86)\Rediff Bol\msvcp71.dll (16944 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Hover.png (767 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Hover.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\modern-wizard.bmp (1856 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Hover.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Click.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Hover.png (788 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\eyerolling_static.gif (253 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\hot.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\surprised_static.gif (262 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\MallikaMsg.wav (1552 bytes)
   %Program Files% (x86)\Rediff Bol\Fetch.dll (3402 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\embarrassed.gif (242 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\cry_static.gif (326 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\idontknow.gif (244 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReplyAll_Disabled.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\Video\Talk&See.exe (28288 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scroll_ld.gif (219 bytes)
   %Program Files% (x86)\Rediff Bol\RBolHandler.exe (9 bytes)
   %Program Files% (x86)\Rediff Bol\msvcr71.dll (12088 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailOpen_Disabled.png (796 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rediff Bol\Rediff Bol 8.0 Messenger.lnk (902 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\WizardResults\Happy.png (458 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sleepy_static.gif (368 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\audiblemenu.xml (250 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\LanguageOptions.txt (569 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\smile_static.gif (234 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_ld.gif (258 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\Flash.ocx (102659 bytes)
   C:\Users\"%CurrentUserName%"\Desktop\Rediff Bol 8.0 Messenger.lnk (884 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\avatars.xml (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sad_static.gif (226 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\RediffBolSettings.ini (6675 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\InetLoad.dll (32 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\angel.gif (3 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\angry.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\RDMarConv.dll (3398 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\rediffsms.xml (196 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\angel_static.gif (327 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Disabled.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailReply_Hover.png (996 bytes)
   %Program Files% (x86)\Rediff Bol\AppWorkingDir\Client\audioport.cfg (6 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\ApplicationIcon.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\MailDelete_Click.png (811 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\IM\IM_Disabled.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\InstallOptions.dll (28 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\idontknow_static.gif (239 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\BusyTone.wav (1856 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\thinking.gif (3 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Click.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Smiley\Smiley_Regular.png (549 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\BolTalkIcon.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\BolChatIcon.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\hot_static.gif (209 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Audibles\bol.in.time_pass.xml (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Sounds\RingingTone-New.wav (3312 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Application\MailIcon.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Disabled.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Buttons\Settings\SettingsIcon_Click.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\sick.gif (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\TalkIcon_Hover.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\Audibles\scrolltabs_rii.gif (401 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\sick_static.gif (206 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsh935.tmp\System.dll (22 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\donttellanyone_static.gif (240 bytes)
   %Program Files% (x86)\Rediff Bol\msvcp60.dll (13584 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\cry.gif (2 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\thinking_static.gif (326 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\surprised.gif (1 bytes)
   C:\Windows\Fonts\Webdunia.ttf (1856 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\NotifyWindow\ChatIcon_Regular.png (1 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Smiley\Default\static\tongueout_static.gif (233 bytes)
   %Program Files% (x86)\Rediff Bol\Client\Resources\Images\AvatarDisplay\AvatarLoading.png (4 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Bol IM" = "%Program Files% (x86)\Rediff Bol\RediffMessenger.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.