Fish wearing a headset (chat-live.gif)

fishwearsheadsetchatlive image fringe loggedin no-preview From URLs which are probably unknown by me > [redacted 1] > https://drive.google.com/drive/ > https://drive.google.com/drive/my-drive > [redacted 2] > Pictures.zip > extracted to directory "Pictures" > file "Snapfish Photos - FREE - 1st 25 Prints.lnk" Downloaded from https://web.archive.org/web/20090625082851/http://www.snapfish.com/registration > https://web.archive.org/web/20150807082819im_/https://images1.snapfish.com/MD5=ba58a2dd92ab23fa6a7c06b6d8b7a5e2/default/images/shoppingcart/chat-live.gif on 2020-07-31 (https://images1.snapfish.com/MD5=ba58a2dd92ab23fa6a7c06b6d8b7a5e2/default/images/shoppingcart/chat-live.gif had HTTP code 404 in 31 Jul 2020 18:13:51 UTC) https://web.archive.org/web/20090227999999/http://www.snapfish.com/hp_iconpc -- 2009-02-27 is the creation date of this file -- and https://web.archive.org/web/1/http://www.snapfish.com/hp_iconpc redirect to https://web.archive.org/web/20090625082851/http://www.snapfish.com/hp_iconpc which redirects to https://web.archive.org/web/20090625082851/http://www.snapfish.com/registration ("http://www.snapfish.com/hp_iconpc | 08:28:51 June 25, 2009 \\ Got an HTTP 302 response at crawl time \\ Redirecting to... \\ http://www.snapfish.com/registration"). If web.archive.org/web/20090227999999/http://www.snapfish.com/hp_iconpc was archived, making an educated guess, I think that it would still redirect to www.snapfish.com/registration. web.archive.org/web/20090625082851/http://www.snapfish.com/registration has the text "6 Jun 2001 - 16 Jan 2020". Links and text thereof thanks to Google (exact text search "Snapfish Photos - FREE - 1st 25 Prints.lnk"): * https://www.techspot.com/community/topics/my-hijackthis-log-vista-antivirus-2010.144033/ - "[2010/02/25 22:14:51 | 000,001,368 | ---- | M] () -- C:\Users\Public\Desktop\Snapfish Photos - FREE - 1st 25 Prints.lnk [2010/02/25 22:14:04 | 000,000,020 | -HS- ..." * https://www.bleepingcomputer.com/forums/t/410113/infected-with-windows-vista-fix-win32alureonen/ - "[2009/01/20 19:41:03 | 000,001,368 | ---- | C] () -- C:\Program Files\Snapfish Photos - FREE - 1st 25 Prints.lnk [2009/01/20 19:40:46 | 000,001,903 | ---- | C] ..." * http://www.geekstogo.com/forum/topic/313032-need-help-cleaning-virusinfected-computer-windows-delayed-writ/ - "[2009/07/17 09:07:57 | 000,001,440 | ---- | M] () -- C:\Users\user\AppData\Local\Temp\smtmp\1\Snapfish Photos - FREE - 1st 25 Prints.lnk [2009/10/02 20:56:48 ..." * http://www.geekstogo.com/forum/topic/284711-application-cannot-be-executed/ - "[2009/05/16 16:35:20 | 000,001,368 | ---- | M] () -- C:\Users\Public\Desktop\Snapfish Photos - FREE - 1st 25 Prints.lnk [2009/05/16 16:34:32 | 000,000,020 | -HS- ..." So it looks like a file with this filename has existed since / did exist in 2009/01/20 19:40:46. I opened this file in a hex editor and removed: * space ( ): 20 * control characters: ** Unit separator (&#x1f;) ** null characters (&#x00;) ** Start of Heading, AKA SOH (&#x01;) ** End-of-transmission character (&#x04;) ** Device Control Four (&#x14;) ** Device Control Three (&#x13;) ** Data Link Escape (&#x10;) ** Start of text (&#x02;) ** Bell (&#x07;) ** End of Text (&#x03;) ** Backspace (&#x08;) ** Form Feed (&#x0c;) ** Enquiry (&#x05;) ** Vertical Tabulation (&#x0b;) ** Acknowledge (&#x06;) ** Line Feed (&#x0a;) ** File Separator (1c) ** Synchronous Idle: 16 ** Operating System Command: 9d ---> LÀFÅ@Ph€S‡ Bi¢ê+00:a€http://www.snapfish.com/hp_iconpcìï¾Î/ßì%»ELÎÍGÂCÔ„+Dhttp://www.snapfish.com/hp_iconpc"www.snapfish.com/hp_iconpcPhttpN-OrderphotoprintsonlinewithSnapfishbyHP"c:\hp\dticons\sf_icon_16_32_48.ico %SystemDrive%\hp\dticons\sf_icon_16_32_48.ico%SystemDrive%\hp\dticons\sf_icon_16_32_48.ico ---> http://cloudandfree.com/en/remove_non_ascii.php ---> LAFA@Ph*S* Bi*e+00:a*http://www.snapfish.com/hp_iconpcii*I/ssi%"ELIIGACO"+Dhttp://www.snapfish.com/hp_iconpc"www.snapfish.com/hp_iconpcPhttpN-OrderphotoprintsonlinewithSnapfishbyHP"c:\hp\dticons\sf_icon_16_32_48.ico %SystemDrive%\hp\dticons\sf_icon_16_32_48.ico%SystemDrive%\hp\dticons\sf_icon_16_32_48.ico ---> Restored/improved (I removed the text which I did not understand the meaning of): http://www.snapfish.com/hp_iconpc www.snapfish.com/hp_iconpc Order photo prints online with Snapfish by HP c:\hp\dticons\sf_icon_16_32_48.ico %SystemDrive%\hp\dticons\sf_icon_16_32_48.ico Properties of this link file: 02/27/2009 10:27 PM 1,368 Snapfish Photos - FREE - 1st 25 Prints.lnk Created: Friday, December 11, 2015, 4:03:45 PM Modified: Friday, February 27, 2009, 9:27:10 PM Accessed: Friday, December 11, 2015 See also: * https://en.wikipedia.org/wiki/Headset_(audio) * https://archive.is/uFLgY * https://twitter.com/ShoNuffKay37/status/1125450311345287169 * https://www.sosordi.net/191686/21-avertissements-de-la-part-de-avira-antivir * https://archive.org/search.php?query=%22Snapfish%22&sin= Thanks to cloudandfree.com/en/remove_non_ascii.php and mothereff.in/html-entities. http://tzworks.net/prototype_page.php?proto_id=11 > https://www.tzworks.net/prototypes/lp/lp32.v.0.97.win.zip didn't help. eng Internet Archive HTML5 Uploader 1.6.4 link; chat-live.gif; LNK file; .lnk; .lnk file; Snapfish Photos - FREE - 1st 25 Prints; Snapfish Photos - FREE - 1st 25 Prints.lnk; GIF image; GIF file; snapfish.com; images1.snapfish.com; Snapfish; fish wearing a headset; fish; animal; fish with a headset Fish wearing a headset (chat-live.gif) leedusmcclein@gmail.com 2020-07-31 22:06:08 2020-07-31 22:06:08 [curator]validator@archive.org[/curator][date]20200731221157[/date][comment]checked for malware[/comment] deemphasize

true