QB2003 paswords changed themselves

Posted by Allan Martin on July 8, 2006, 10:31 pm

Please log in for more thread options

> [comments at bottom]

>>>

>>>>Z Man wrote:

>>>>> Our small office is running Quickbooks Premiere 2003 Accountants

>>>>> Edition,

>>>>> five user version. We run in multi user mode and have four users set

>>>>> up.

>>>>> When I arrived in the office this morning, I could not access my QB

>>>>> file.

>>>>> Regardless of which user/pw combo I tried, none were valid. When I

>>>>> eventually managed to access my file, I found that all four of the

>>>>> users/pws

>>>>> had been changed. The users were the same, but the pw for each had

>>>>> become a

>>>>> random combination of six letters and numbers. I tried to change one,

>>>>> but

>>>>> the change did not 'take' and I must still use the random password.

>>>>>

>>>>> I am completely bewildered as to how this could have happened. No one

>>>>> was in

>>>>> the office over the Independence Day weekend and no one used the

>>>>> computer

>>>>> system at all. How could the passwords for all my accounts have

>>>>> changed

>>>>> themselves?

>>>>>

>>>>

>>>> 1) I don't know how you found out what the passwords were changed to as

>>>> in every copy I've ever seen of 2003 there is no way to display a

>>>> password! If you have some third party password hacker program that is

>>>> where I would start looking for why they changed and how the file got

>>>> damaged.

>>>>

>>>> 2) You say you can't change them, that would be file corruption,

>>>> rebuild.

>>>>

>>>> 3) Can you create a new user/pw? If you can't that would be file

>>>> corruption, rebuild.

>>>>

>>>> 4) Does anyone have access (physical or electronic [go to my pc]) to

>>>> the machine where the data file is stored? Especially anyone recently

>>>> fired?

>>>

>>> I tried again to change the admin password, and this time I was

>>> successful. I have not tried setting up a new user id yet. This is a

>>> small office with only a handful of staffers. Everyone has been there

>>> for a while. After this problem occurred, I also tried accessing backup

>>> copies stored in out of the way places on other computers, and had the

>>> same problem. I also tried it from two other computers on the network,

>>> with the same results.

>> Define tried it from two other computers on the network. Does this mean

>> you sat down at different workstations and opened various client files

>> and found the same results? Have you tried opening the files on a

>> computer that is off site?

>> Hate to say this but is there any chance that the passwords did not

>> change, only your recollection of them. Hey when you are going crazy

>> strange things tend to happen. Don't dismiss this theory, major part of

>> crazy is also denial. For example look at our friend nospam. Do you think

>> he knows that he is crazy?

>> All kidding aside I believe this is the work of a disgruntled employee

>> but I have not fully dismissed the crazy theory. I will keep a close look

>> at your future posts.

> The company file in question is our own company file. We also work on

> client QuickBooks files, but the problem is with our own. Each of our

> four staffers has a pw comprising his/her initials followed by the same

> four number. The new pw's are a random set of letters and numbers. The

> file is located on our file server running Windows 2003 Server, Enterprise

> Edition. About six computers have access to the file server, and four have

> QuickBooks installed. I attempted to log into our company files from three

> of the four computers that have QuickBooks installed.

> After reading the responses, several of which addressed a serious issue

> with flippant answers (would they feel it to be so humorous if it were

> their own files instead of mine?),

Pie in your face is funny, pie in my face is not.

I am no closer to an answer than I was originally.

> However, I do not think it was sabotage by a disgruntled employee (two

> were actually on vacation all of last week), nor do I think we simply

> forgot our passwords. I do believe it possible that some sort of malware

> specific to QuickBooks (no other files were effected) was at work, or

> there was spontaneous corruption that effected only passwords. Of course,

> this is mere speculation. I have no hard evidence to support these

> theories. BTW, I did not take one additional step I could have taken...I

> could try an older backup copy stored off premises, either from a portable

> hard drive or a DVD. If I get a chance, I will try older backups to see if

> they will open. My local backups may have already been overwritten by the

> errant file before I tried them.

Posted by HeyBub on July 8, 2006, 10:38 pm

Please log in for more thread options

Z Man wrote:

> After reading the responses, several of which addressed a serious

> issue with flippant answers (would they feel it to be so humorous if

> it were their own files instead of mine?), I am no closer to an

> answer than I was originally. However, I do not think it was sabotage

> by a disgruntled employee (two were actually on vacation all of last

> week), nor do I think we simply forgot our passwords. I do believe it

> possible that some sort of malware specific to QuickBooks (no other

> files were effected) was at work, or there was spontaneous corruption

> that effected only passwords. Of course, this is mere speculation. I

> have no hard evidence to support these theories. BTW, I did not take

> one additional step I could have taken...I could try an older backup

> copy stored off premises, either from a portable hard drive or a DVD.

> If I get a chance, I will try older backups to see if they will open.

> My local backups may have already been overwritten by the errant file

> before I tried them.

The answers weren't flippant. When confronted with a problem, one attacks it
with the more likely causes first. In your case, the symptoms were caused
(in order of likelihood) by:

1. Somebody maliciously changed the passwords. (99%)
2. Everybody simultaneously forgot their passwords. (<1%)
3. Malware unique to QB never before reported (< 0.001%)
4. File corruption affecting only the password area of QB (vanishingly small
percentage)

Anyway, QB password cracking programs exist. Once you get back in, perhaps
you can review semi-secret logs to determine when/who/how the passwords were
changed.

Posted by Allan Martin on July 9, 2006, 10:20 am

Please log in for more thread options

>Z Man wrote:

>> After reading the responses, several of which addressed a serious

>> issue with flippant answers (would they feel it to be so humorous if

>> it were their own files instead of mine?), I am no closer to an

>> answer than I was originally. However, I do not think it was sabotage

>> by a disgruntled employee (two were actually on vacation all of last

>> week), nor do I think we simply forgot our passwords. I do believe it

>> possible that some sort of malware specific to QuickBooks (no other

>> files were effected) was at work, or there was spontaneous corruption

>> that effected only passwords. Of course, this is mere speculation. I

>> have no hard evidence to support these theories. BTW, I did not take

>> one additional step I could have taken...I could try an older backup

>> copy stored off premises, either from a portable hard drive or a DVD.

>> If I get a chance, I will try older backups to see if they will open.

>> My local backups may have already been overwritten by the errant file

>> before I tried them.

> The answers weren't flippant. When confronted with a problem, one attacks

> it with the more likely causes first. In your case, the symptoms were

> caused (in order of likelihood) by:

> 1. Somebody maliciously changed the passwords. (99%)

> 2. Everybody simultaneously forgot their passwords. (<1%)

> 3. Malware unique to QB never before reported (< 0.001%)

> 4. File corruption affecting only the password area of QB (vanishingly

> small percentage)

5. OP is going crazy (10%)
6. OP is pulling our leg and incident is made up (20%)
7 OP accidently put on someone else's eye glasses and passwords appear
incorrect (25%)
8. OP eat tainted gazpacho during the 4th which caused dyslexia and now
only thinks passwords are jumbled around. (Priceless)

> Anyway, QB password cracking programs exist. Once you get back in, perhaps

> you can review semi-secret logs to determine when/who/how the passwords

> were changed.

Posted by Golden California Girls on July 9, 2006, 3:11 am

Please log in for more thread options

Z Man wrote:

> [comments at bottom]

>>>> Z Man wrote:

>>>>> Our small office is running Quickbooks Premiere 2003 Accountants

>>>>> Edition,

>>>>> five user version. We run in multi user mode and have four users set

>>>>> up.

>>>>> When I arrived in the office this morning, I could not access my QB

>>>>> file.

>>>>> Regardless of which user/pw combo I tried, none were valid. When I

>>>>> eventually managed to access my file, I found that all four of the

>>>>> users/pws

>>>>> had been changed. The users were the same, but the pw for each had

>>>>> become a

>>>>> random combination of six letters and numbers. I tried to change one,

>>>>> but

>>>>> the change did not 'take' and I must still use the random password.

>>>>>

>>>>> I am completely bewildered as to how this could have happened. No one

>>>>> was in

>>>>> the office over the Independence Day weekend and no one used the

>>>>> computer

>>>>> system at all. How could the passwords for all my accounts have changed

>>>>> themselves?

>>>>>

>>>> 1) I don't know how you found out what the passwords were changed to as

>>>> in every copy I've ever seen of 2003 there is no way to display a

>>>> password! If you have some third party password hacker program that is

>>>> where I would start looking for why they changed and how the file got

>>>> damaged.

>>>>

>>>> 2) You say you can't change them, that would be file corruption,

>>>> rebuild.

>>>>

>>>> 3) Can you create a new user/pw? If you can't that would be file

>>>> corruption, rebuild.

>>>>

>>>> 4) Does anyone have access (physical or electronic [go to my pc]) to the

>>>> machine where the data file is stored? Especially anyone recently

>>>> fired?

>>> I tried again to change the admin password, and this time I was

>>> successful. I have not tried setting up a new user id yet. This is a

>>> small office with only a handful of staffers. Everyone has been there for

>>> a while. After this problem occurred, I also tried accessing backup

>>> copies stored in out of the way places on other computers, and had the

>>> same problem. I also tried it from two other computers on the network,

>>> with the same results.

>> Define tried it from two other computers on the network. Does this mean

>> you sat down at different workstations and opened various client files and

>> found the same results? Have you tried opening the files on a computer

>> that is off site?

>> Hate to say this but is there any chance that the passwords did not

>> change, only your recollection of them. Hey when you are going crazy

>> strange things tend to happen. Don't dismiss this theory, major part of

>> crazy is also denial. For example look at our friend nospam. Do you think

>> he knows that he is crazy?

>> All kidding aside I believe this is the work of a disgruntled employee but

>> I have not fully dismissed the crazy theory. I will keep a close look at

>> your future posts.

> The company file in question is our own company file. We also work on client

> QuickBooks files, but the problem is with our own.

No chance someone thought they had a client file / sample file open and
zapped the PW's in the wrong file?

>Each of our four

> staffers has a pw comprising his/her initials followed by the same four

> number. The new pw's are a random set of letters and numbers. The file is

> located on our file server running Windows 2003 Server, Enterprise Edition.

> About six computers have access to the file server, and four have QuickBooks

> installed. I attempted to log into our company files from three of the four

> computers that have QuickBooks installed.

> After reading the responses, several of which addressed a serious issue with

> flippant answers (would they feel it to be so humorous if it were their own

> files instead of mine?), I am no closer to an answer than I was originally.

> However, I do not think it was sabotage by a disgruntled employee (two were

> actually on vacation all of last week), nor do I think we simply forgot our

> passwords. I do believe it possible that some sort of malware specific to

> QuickBooks (no other files were effected) was at work, or there was

> spontaneous corruption that effected only passwords. Of course, this is mere

> speculation. I have no hard evidence to support these theories. BTW, I did

> not take one additional step I could have taken...I could try an older

> backup copy stored off premises, either from a portable hard drive or a DVD.

Do so and on a computer not on your network if you have one. Then check
it on a computer on your network. Curious to hear the result.

> If I get a chance, I will try older backups to see if they will open. My

> local backups may have already been overwritten by the errant file before I

> tried them.

None of us asked, any thing that might point to hardware? Power surges,
lights blinking, etc. No temperature extremes? Anyone trip over a
network cable? Windoze server logs indicate any drive faults? You know
the usual suspects when there are unexplained stuff going on with any file.

Other stuff not asked: Disgruntled client? Wi-Fi turned off? Hardware
firewall?

Did you do a verify/rebuild on the file? If so what did it find?
qbwin.log file.