Hi,

Unfortunately I have too much going on now to directly help, but I can point you in some directions:

A lot of these programs that saved video footage to EXE files during that era usually embed a common video file into the EXE instead of using their own formats, most of the time either AVI or QuickTime, in that case you can use a file ripper/extraction/forensic utility(On Linux for example:https://manpages.debian.org/trixie/testdisk/p … torec.8.en.html(Should be in the testdisk package) or https://packages.debian.org/stable/admin/foremost, I don't know what is state of the art on Windows now) to recover the embedded video file.

Obviously before running such a utility backup the EXE files.

Can you point us at a file of this type to "play" with?

Some modern video editing tools may know how to open/extract the video.

Also you may be able to use a screen video recording tool to capture the video as it plays.

I've got both Win95 and 98 running in PCem, and 98 running in VMware ... I've heard that VirtualBox can do screen recording, might be worth a bit of experimentatio.

Do these video .EXEs only play in 95/98, not XP or Win7? - XP and Win7/32 tended to be pretty good at running 95/98 native stuff and I've got more systems with more tools running those.

Hopefully, all it needs is some Resource Manager.

I would also consider the idea presented by @DaveDDS of possibly using screen recorder software instead of extracting the data from the .EXE file, if the videos were originally made on a Win98 class PC in real-time (as webcam/video-phone suggests), a modern computer would have no problem recording it without dropping frames as I expect at most 30 FPS(Most likely less) from a recording made by a computer at that time, and also low resolutions, so for a modern computer it would be trivial to capture that amount of data while also playing it back, as long as the drivers function properly.

Obviously no one expects to be able today to take an EXE, label it a "video", have it survive a trip through email, and have the recipient be gullible enough to open it. Nonetheless if you go back to the 90s there are basically two ways this might be designed:

1. A stub EXE and the video file are literally concatenated together to produce the video EXE. In this case the EXE is not modified at all. Self-extracting ZIP files work exactly like this. The way you would know this happened is if the file is bigger than the end of the last PE section indicated in the EXE header. For reasons unknown this "extraneous data beyond the end of the PE" has become known as an "overlay" in the reverse engineering community, not to be confused with the "libraries overlapping in address space" meaning of 16-bit machines.

2. As Grzyb mentioned, there is EXE functionality designed to accommodate this (icons, graphics, etc., but can be repurposed for any large binary object) such that an already built EXE can be readily patched, which is the resource section, and Resource Hacker can indeed list the contents of it and isolate the video file.

I would say there's a good chance that, even though the EXE file may have the video in AVI format contained within it, the video is encoded using some proprietary codec that there is no modern way to play back. There were all sorts of wacky proprietary audio and video codecs back in the day.

Or it might just be something stupidly simple like MJPEG. 😁

jakethompson1 wrote on 2026-07-08, 19:51:

Obviously no one expects to be able today to take an EXE, label it a "video", have it survive a trip through email, and have the recipient be gullible enough to open it. ...

I don't see any problem with sending an .EXE by email - nowadays many email clients block evil executable files, which is why I wrote an encryptor to encode executables to email, I just let the recipient know that they can get the decoder from my site. (and hopefully somebody I'm helping with something can trust me enough to do that) - running an executable you just got from some random person is another thing altogether!

And... another good reason to do stuff like this in virtual machines ... I have backups of the raw working VM disks .. I restore a fresh VM, run the executable ... it can't do anything outside of the VM which I delete after trying whatever it is anyway..