Environment variables don't need to have equals signs in them. They're just a series of null-terminated strings, followed by another null string.
QUOTE
what address would I start at to inspect my environmental memory area, to see what's on either side of those 20"x"'s?
Here's one way...
run DEBUG and then do
d 0 command, this shows PSP and looks like this (addresses may vary):
CODE
-d 0
129E:0000 CD 20 00 A0 00 9A EE FE-1D F0 4F 03 23 0C 8A 03 . ........O.#...
129E:0010 23 0C 17 03 23 0C 17 0B-01 01 01 00 02 FF FF FF #...#...........
129E:0020 FF FF FF FF FF FF FF FF-FF FF FF FF*01*0C*4E 01 ..............N.
129E:0030 2A 10 14 00 18 00 9E 12-FF FF FF FF 00 00 00 00 *...............
129E:0040 07 0A 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
129E:0050 CD 21 CB 00 00 00 00 00-00 00 00 00 00 20 20 20 .!...........
129E:0060 20 20 20 20 20 20 20 20-00 00 00 00 00 20 20 20 .....
129E:0070 20 20 20 20 20 20 20 20-00 00 00 00 00 00 00 00 ........
Now find the word at
2c - third line, fourth and third bytes from the end, I've highlighted that area with asterisks above (01 0C); in this case it's 0C01 - and display the start of that segment, you can use d command without address to continue displaying:
CODE
-d c01:0
0C01:0000 54 4D 50 3D 43 3A 5C 57-49 4E 44 4F 57 53 5C 54 TMP=C:\WINDOWS\T
0C01:0010 45 4D 50*00*54 45 4D 50-3D 43 3A 5C 57 49 4E 44 EMP.TEMP=C:\WIND
0C01:0020 4F 57 53 5C 54 45 4D 50*00*50 52 4F 4D 50 54 3D OWS\TEMP.PROMPT=
0C01:0030 24 70 24 67*00*77 69 6E-62 6F 6F 74 64 69 72 3D $p$g.winbootdir=
0C01:0040 43 3A 5C 57 49 4E 44 4F-57 53*00*43 4F 4D 53 50 C:\WINDOWS.COMSP
0C01:0050 45 43 3D 43 3A 5C 57 49-4E 44 4F 57 53 5C 43 4F EC=C:\WINDOWS\CO
0C01:0060 4D 4D 41 4E 44 2E 43 4F-4D*00*50 41 54 48 3D 43 MMAND.COM.PATH=C
0C01:0070 3A 5C 57 49 4E 44 4F 57-53 3B 43 3A 5C 57 49 4E :\WINDOWS;C:\WIN
-d
0C01:0080 44 4F 57 53 5C 43 4F 4D-4D 41 4E 44 3B 43 3A 5C DOWS\COMMAND;C:\
0C01:0090 57 49 4E 44 4F 57 53 5C-53 59 53 54 45 4D*00*43 WINDOWS\SYSTEM.C
0C01:00A0 4D 44 4C 49 4E 45 3D 77-69 6E*00*77 69 6E 64 69 MDLINE=win.windi
0C01:00B0 72 3D 43 3A 5C 57 49 4E-44 4F 57 53*00 00*4C 41 r=C:\WINDOWS..LA
The highlighted zeroes indicate the end of each string in the environment block. Two zeroes in a row indicate the end of the environment block.
My suspicion is that this behavior is caused by a Virus, if you have already checked to see if any environment variables are being set on startup.
