screensaver password reverting to old password intermittently

N

Nick

Any idea why my Win98SE screen saver password every few weeks reverts
to the old password? The new one fails after it worked fine for days.
The screen saver is native to the OS. The network password remains
what it should be. I change the screensaver password and everything's
okay until some weeks later. No one else uses the machine and it's not
on the Internet. I use profiles as if for multiple users (I forgot
what apparently worked better that way), but mine's been the only
login all this time. I'm not going to a previous state with registry
and startup files, and if Win is doing that without telling me it's
not telling me, but whether the reversion only happened after a cold
reset I don't recall. Nothing useful in <SYSTEM.INI>.

Wasn't a problem before the last time I changed the screensaver
password, which is also after the *.pwl file was last modified (I
changed my login password then, too). I don't know where the
screensaver password is stored, but "Underwater (high color).theme",
Underwater.scr, & Underwater.dll were last modified in 1999, as are
all of "C:\Program Files\Plus!\Themes\Underwater*.*", which should
eliminate them and it's not in the registry (unless encrypted).
According to Find for the whole computer, the only files modified the
same recent day I last changed my password were C:\WINDOWS\TEMP
\~DFE6E9.TMP, ...\~DF5F4C.TMP, ...\~DF52A4.TMP, & ...\~DF60EA.TMP
(each 3,584 bytes) they respectively contain the following plain
English per Notepad: ~DFE6E9.TMP has "R o o t E n t r y",
~DF5F4C.TMP has "R o o t E n t r y", DF52A4.TMP has "R o o t E n t
r y", & ~DF60EA.TMP has "R o o t E n t r y", "SCANDSKW", "SETUP",
"W8Ç" (unknown if relevant to platform being Win98SE), "SETUP",
"SETUP", "SETUP", "SETUP1", "SOFFICE", "SOUNDMAN" (I don't know what I
have in the bought-as-barebones machine that's about Soundman or in
the homebuilt that used to house the HDD w/ same OS), "SPOOL32",
"ST6UNST", "START", "STPSUP", "SUCATREG", "SYSINFO ?", "SYSMON", &
"SYSTRAY".

As an experiment, I changed the password recently to the normal
password twice via each of two methods (via Display and Passwords
applets), i.e., 4 times total. Every time it said it had successfully
been changed, which means it can't tell the difference if there's no
real change. I tested the password correction it works now.

One hunch: The old password was 8 characters long, all different. The
new password is the same minus the rightmost character. (I know that
kind of change is weak security, but that's a different subject. I
should tighten that after I solve this problem.) Could the similarity
mean Win is sometimes remembering the old one?

I'm glad I know this old password, but I shouldn't have to. I usually
discard them. Ideas?

Thanks.

--
Nick
 
P

philo

"Nick" <Nick_Levinson@yahoo.com> wrote in message
news:00fd14c5-b988-4183-bf1c-6fee74ceb207@59g2000hsb.googlegroups.com...
Any idea why my Win98SE screen saver password every few weeks reverts
to the old password? The new one fails after it worked fine for days.
The screen saver is native to the OS. The network password remains
what it should be. I change the screensaver password and everything's
okay until some weeks later. No one else uses the machine and it's not
on the Internet. I use profiles as if for multiple users (I forgot
what apparently worked better that way), but mine's been the only
login all this time. I'm not going to a previous state with registry
and startup files, and if Win is doing that without telling me it's
not telling me, but whether the reversion only happened after a cold
reset I don't recall. Nothing useful in <SYSTEM.INI>.

Wasn't a problem before the last time I changed the screensaver
password, which is also after the *.pwl file was last modified (I
changed my login password then, too). I don't know where the
screensaver password is stored, but "Underwater (high color).theme",
Underwater.scr, & Underwater.dll were last modified in 1999, as are
all of "C:\Program Files\Plus!\Themes\Underwater*.*", which should
eliminate them and it's not in the registry (unless encrypted).
According to Find for the whole computer, the only files modified the
same recent day I last changed my password were C:\WINDOWS\TEMP
\~DFE6E9.TMP, ...\~DF5F4C.TMP, ...\~DF52A4.TMP, & ...\~DF60EA.TMP
(each 3,584 bytes) they respectively contain the following plain
English per Notepad: ~DFE6E9.TMP has "R o o t E n t r y",
~DF5F4C.TMP has "R o o t E n t r y", DF52A4.TMP has "R o o t E n t
r y", & ~DF60EA.TMP has "R o o t E n t r y", "SCANDSKW", "SETUP",
"W8Ç" (unknown if relevant to platform being Win98SE), "SETUP",
"SETUP", "SETUP", "SETUP1", "SOFFICE", "SOUNDMAN" (I don't know what I
have in the bought-as-barebones machine that's about Soundman or in
the homebuilt that used to house the HDD w/ same OS), "SPOOL32",
"ST6UNST", "START", "STPSUP", "SUCATREG", "SYSINFO ?", "SYSMON", &
"SYSTRAY".

As an experiment, I changed the password recently to the normal
password twice via each of two methods (via Display and Passwords
applets), i.e., 4 times total. Every time it said it had successfully
been changed, which means it can't tell the difference if there's no
real change. I tested the password correction it works now.

One hunch: The old password was 8 characters long, all different. The
new password is the same minus the rightmost character. (I know that
kind of change is weak security, but that's a different subject. I
should tighten that after I solve this problem.) Could the similarity
mean Win is sometimes remembering the old one?

I'm glad I know this old password, but I shouldn't have to. I usually
discard them. Ideas?

Thanks.



Are there any other problems with the machine? It looks like a former
registry might have been loaded.
That would be easy enough to test by manually backing up the registry, then
restoring it if the password
settings were again lost.

If it does turn out to be a registry 'roll back'
then there is of course the possiblity the corruption is due to a hardware
problem

as a precaution I'd run a RAM test

http://oca.microsoft.com/en/windiag.asp

and also the harddrive manufacturer's diagnostic.

Even if nothing turns up...It's not an entirely bad idea to run such
utilites on occasion.

Finally: I am not sure why you are using a screen saver password. Though
that's up to you of course...
someone could easily access your system by simply rebooting the computer...
(unless you also have a bios password)
 
F

Franc Zabkar

On Sun, 30 Mar 2008 14:31:32 -0700 (PDT), Nick
<Nick_Levinson@yahoo.com> put finger to keyboard and composed:

>As an experiment, I changed the password recently to the normal
>password twice via each of two methods (via Display and Passwords
>applets), i.e., 4 times total. Every time it said it had successfully
>been changed, which means it can't tell the difference if there's no
>real change. I tested the password correction it works now.
>
>One hunch: The old password was 8 characters long, all different. The
>new password is the same minus the rightmost character. (I know that
>kind of change is weak security, but that's a different subject. I
>should tighten that after I solve this problem.) Could the similarity
>mean Win is sometimes remembering the old one?
>
>I'm glad I know this old password, but I shouldn't have to. I usually
>discard them. Ideas?
>
>Thanks.


I enabled the Flying Windows screensaver and gave it a password of
"ABC". I then changed the password to "ABD".

I compared the registry before and after making the changes. Only one
key was affected:

HKEY_CURRENT_USER\Control Panel\Desktop

Before (password = ABC):

"ScreenSave_Data"=hex:30,39,41,43,33,35,00

After (password = ABD):

"ScreenSave_Data"=hex:30,39,41,43,33,32,00

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.
 
N

Nick

Solved the problem. My Win is in multi-user mode, so the registry has
at least 2 sets of screensaver settings, one for .DEFAULT and one for
each user. Since changing screen saver settings via the Control Panel
applet essentially requires opening the Start menu, and that can't be
opened until someone's logged in, changes via the applet will affect
only the currently logged-in user, not the default. Since I had a
screensaver password before changing Win from single-user to multi-
user mode, on the rare occasions that the screen saver kicked in
before the Win login it used the default settings in the registry that
the applet couldn't edit, and thus reverted to my old password.
Solution: In Registry Editor, I copied the password from the user
value to the .DEFAULT value.

More details: http://www.forum.scottmueller.com/viewtopic.php?p=1830#1830

Responding to philo -- good ideas:
--- On hardware issues: I agree on running hardware utilities now and
then and have a bunch, even if I keep not doing it because it's a pain
to have to. However, a general principle based on statistics is that
far more errors are software-based than hardware-based and far more
errors are user-generated than not. Since the machine's been working
pretty well and there wasn't other evidence of hardware failure, I
looked at software.
--- I do have a BIOS password and screensavers lock out well-meaning
folks, which makes them helpful if not used as the only security
method.

Franc:
--- You probably shouldn't edit that key if you want your edit to
survive a reboot (except you should if it's only for the current
session and not surviving is what you want). Even if your Win98SE is
in single-user mode, for a permanent edit you probably should edit in
HKEY_USERS and then reboot, although I haven't checked that mode.
--- The password should have turned up in your registry in 2 places,
not 1.
--- I mistakenly thought Google would notify me of a reply, so I
missed it earlier, but we wound up looking at the same general place.

Thanx.

--
Nick
 
F

Franc Zabkar

On Sat, 5 Apr 2008 11:55:15 -0700 (PDT), Nick
<Nick_Levinson@yahoo.com> put finger to keyboard and composed:

>Solved the problem. My Win is in multi-user mode, so the registry has
>at least 2 sets of screensaver settings, one for .DEFAULT and one for
>each user.


<snip>

>Franc:
>--- You probably shouldn't edit that key if you want your edit to
>survive a reboot (except you should if it's only for the current
>session and not surviving is what you want). Even if your Win98SE is
>in single-user mode, for a permanent edit you probably should edit in
>HKEY_USERS and then reboot, although I haven't checked that mode.
>--- The password should have turned up in your registry in 2 places,
>not 1.


Sorry, you're right. The reason I detected the change in only one key
is because I used Regedit to make backups of the registry before and
after each change, and then compared the two .reg files as follows:

fc before.reg after.reg > diffs.txt

Unfortunately regedit only backed up the registry from
HKEY_LOCAL_MACHINE and onwards. It didn't save HKEY_CLASSES_ROOT or
HKEY_CURRENT_USER.

So the diffs.txt file showed only one difference in Screensave_Data
(see below), and I assumed this was at HKEY_CURRENT_USER\Control
Panel\Desktop.

Comparing files before.reg and after.reg

****** before.reg

"PaintDesktopVersion"="0"
"ScreenSave_Data"=hex:37,39,44,43,34,35,00
"ScreenSaveLowPowerTimeout"="900"

****** after.reg

"PaintDesktopVersion"="0"
"ScreenSave_Data"=hex:37,43,44,42,34,30,00
"ScreenSaveLowPowerTimeout"="900"

******

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.
 
Back
Top Bottom