Viewing Embedded Code in Email

Does anyone know how to view embedded code in emails. For instance i would like to view the source of an email that contains a virus and see the code for the virus. I took a sample email that contained a picture just to see how it was embedded. Basically i just did a file-> save as from outlook and saved it as a html. I beleive it showed a CID for the embedded picture. Now this leads to my next question. The differences in attached viruses and viruses that don't show up as an attachment. If the virus comes in as an attachment, where is it stored? Does the CID reference some location? I am assuming that if the virus is not an attachment, it should show up in the html code as vbs or javascript or something. Am I on the right track?

Critter

Once again you have related but different questions :)

OK, you need to find where your mail is stored and you need to be able to get it onto your box as a .txt file, then just open it in notepad, wordpad or whatever, and away you go.

Attachments are stored wherever your mailer stores them........not really a problem as you should have the facility to download them through your mailer. Just save them as .txt files and you can examine them at your leisure.

Do not open anything suspicious in HTML or within your mailer unles you have it very well protected.

Basic rules:

1. Download item as .txt file
2. Examine in notepad or wordpad

Cheers

it would also be a good idea to make sure you have full headers enabled in your email program, if you do get a virus (even if it doenst do anything) you will probably want to see where it is coming from...

how do I enable full headers in outlook?

Hello Critter

Well if it is Virus you are interested in you would do yourself good to learn Assemble Language. This is what the best virus writers use because it is small and can be made to fool AV software. I will include a little note on virus writing for educational purposes only.

Virus writing is not as hard as you might first imagine. To write an effective virus, however, you *must* know assembly language. Short, compact code are hallmarks of assembly language and these are desirable characteristics of virii. However, it is *not* necessary to write in pure assembly. C may also be used, as it allows almost total control of the system while generating relatively compact code (if you stay away from the library functions). However, you still must access the interrupts, so assembly knowledge is still required. However, it is still best to stick with pure assembly, since most operations are more easily coded in assembly. If you do not know assembly, I would recommend picking up a copy of The Microsoft Macro Assembler Bible (Nabajyoti Barkakati, ISBN #: 0-672-22659-6). It is an easy-to-follow book covering assembly in great detail. Also get yourself a copy of Undocumented DOS (Schulman, et al, ISBN #0-201-57064-5), as it is very helpful.

CyberSorcerer