Introduction

Advanced Office 2000 Password Recovery (or simply AO2000PR) has been designed for recovering the lost passwords for the documents/files created in the following applications:

•	Microsoft Word

•	password to open

•	password to modify

•	document protection password

•	VBA project password (*)

•	Microsoft Excel

•	password to open

•	password to modify

•	workbook password

•	shared workbook password

•	sheet passwords

•	VBA project password (*)

•	unlocking protected plug-ins (XLA) (*)

•	Microsoft Access

•	password to open

•	user-level passwords (*)

•	database owner and security ID (*)

•	Microsoft PowerPoint 97 (*)

•	VBA project password

•	Microsoft Project (*)

•	password to open

•	password to modify

•	VBA project password

•	Microsoft Outlook (*)

•	Microsoft Money

•	Microsoft Backup (Windows 95/98) (*)

•	Microsoft Schedule+ (*)

•	Microsoft Mail (*)

•	Microsoft Internet Explorer 3/4/5 (Content Advisor)

•	Visio 4/5 (VBA project password) (*)

•	VBA “backdoor” feature (works for all MS Office 97 and Office 2000 applications, as well as other programs which have VBA projects) (*)

The program is compatible with all international (non-English) versions of MS Office. Most passwords are being recovered (or removed) instantly. However, “password to open” in Office 97/2000 is encrypted with a very strong algorithm and requires time-consuming brute-force or dictionary attacks to be performed; the success/recovery rate is about 80-85%, but if the password is long (8+ characters) and complex, it cannot be recovered at all (in a reasonable time). MS Office XP files are also supported, but “password to open” can be recovered only if “compatible” (with Office 95 or Office 97/2000) encryption has been used; for files protected using CSP (Cryptographic Service Provider) all passwords but “password to open” are supported.

(*) Professional version only


Requirements

•	Windows 95, Windows 98, Windows ME, Windows NT 4.0, Windows 2000 or Windows XP running on Pentium CPU

•	8 megabytes of RAM

•	about 2 megabytes of hard disk space


About Office passwords

Most of the passwords for Office documents and files are not secure and can be recovered (or removed, or changed) instantly:

•	Microsoft Office (prior to Office 97)

•	Microsoft Word 97/2000/XP (all passwords except the one to open)

•	Microsoft Excel 97/2000/XP (all passwords except the one to open)

•	Microsoft Access

•	Microsoft PowerPoint

•	Microsoft Project

•	Microsoft Outlook

•	Microsoft Money

•	Microsoft Backup

•	Microsoft Schedule+

•	Microsoft Mail

•	Microsoft Internet Explorer (Content Advisor)

•	Visio

The “password to open” in Word/Excel 97/2000/XP, however, is really hard to break. More details are available here.


General information

Simply selection the file you want to recover the password(s) for. Press the Load Office document into the project button and select an appropriate file (or press on a small arrow at the right to load a recent file you have been working with recently); file format will be recognized automatically with corresponding message in the Status window; if the specified file format is not supported by AO2000PR, or it's corrupted, or used by another application – appropriate error message will be displayed.

In most cases, the password will be decrypted instantly (see next chapters for more info).


Word/Excel 97/2000 document (password to open)

When you assign the “open” password to your Word or Excel 97/2000 document (so the user will have to enter it to open the file), Microsoft Office encrypts the document using relatively complicated algorythm (without storing the password itself inside the file), so it is impossible to retrieve it at all. However, AO2000PR can recover the lost password using the brute-force and dictionary attacks. For the "brute-force" attack, you have to set up the password length (it is limited to 15 characters) and password range (which, by the way, can include a national symbols). See Type of attack chapter for more details. Don’t expect to recover long (8+ characters) and complex passwords in a reasonable time, though.


Word/Excel 97/2000 document (password to open; French regional settings)

If the Word/Excel 97/2000 document you've opened has been created on a machine with French regional settings, the password will be recovered instantly, i.e. without the brute-force. However, there are some Word 97/2000 files (also “French”), not supported by AO2000PR at all – very short, for example. For them, the following message is displayed:

Not enough text to analyze. The password for this file cannot be recovered with AO2000PR.

or just

The password for this file cannot be recovered with AO2000PR.


Word/Excel 95, PowerPoint, Project, Money, Backup, Visio

The program simply displays the passwords in a message box, and also writes them to the log window. For Access databases, the program also prints the database owner (name) and security ID – using that information, you can create the same user in your current Access setup, login to Access under that name, and open your database – you’ll have all necessary permissions to view and modify the data.


Word document (all versions; all passwords except the one to open)

All passwords for the given file will be shown in one window:

Please note that in some cases, it is not possible to recover the document protection password at all. However, that password can be changed or removed; the program will prompt you to do that.


Excel document (all versions; all passwords except the one to open)

All the passwords for Excel documents (except the one to open) are recovered instantly and shown in the single window:

Please note that some of these passwords (shown by AO2000PR) may differ from ones originally set in Excel. However, Excel will accept them without problems.


Access database (share-level password, owner information)

For Access databases (*.mdb), the program shows the following information:

•	Access version

•	share-level (database) password

•	database owner

•	list of objects and their owners

Here is an example:

In most cases, all you need is just the database password. However, if the database has user-level security set, and wordgroup administration file (system.mda or system.mdw) is not available (if it is there, you can just get all the user names and passwords from it – see next chapter for details), you will also need database owner information.

In the example shown above, the database owner is ‘Developer’, and his ID is ‘7658’. To gain access to this file, you need to do the following:

•	Run MS Access (same version your file has been created with, as shown by AO2000PR).

•	Create new database (or open any existing not-protected one).

•	Go to Accounts setup (usually, it is in Tools | Security | User And Group Accounts), Users tab.

•	Create a new user with 'Developer' name (without quotes; just type that name in "Name" drop-down combo box, and press New button). Access will open a new window with two fields -- name ('Developer' will be already there) and "Personal ID". In the second one, type '7658' (also without quotes) and press OK.

•	Close Accounts window with OK and exit from Access.

•	Run Access from the command line with the '/user' option, i.e.:

MSACCESS.EXE /user

•	You'll be prompted for user name and password; type 'Developer' as the name, and empty password.

•	Now open your (protected) database, and you should have all necessary permissions (as database owner).

Sometimes, some objects (tables, queries, reports etc) in the database have the owner different from the database one, so AO2000PR shows the complete list of all objects in the given file, together with the owner names and IDs.


Access database (user-level passwords)

For system Access databases (usually, system.mda or system.mdw), the program displays a window with two tabs – Groups information and Users information. The first one displays what groups the users belong to:

The second one displays the passwords for all users:


Outlook personal storage file

When Outlook PST file is opened, AO2000PR shows the password for it immediately. But please note that in some cases it is not the same as the one which has been originally set. That's due to encryption algorythm used in Outlook – the password is not stored in the file. But that password (shown by AO2000PR) will be accepted by Outlook without problems. And of course, after logging into Outlook, you'll be able to change that password to any one, or just remove it.

For your convenience, when the password is found, the program copies it into the Clipboard, and allows you to run Outllook; in Outlook, just put the cursor into the "password" box, and press Ctrl-V or Ctrl-Ins there to paste the password from the Clipboard (and so avoid mistyping).


MS Mail and Schedule plus

The program simply displays the password in a message box, and also writes it to the log window.


Internet Explorer (Content Advisor)

The password for Content Advisor (available in Internet Explorer 3, 4 and 5), unfortunately, cannot be recovered, but it is possible to change it. Just press the IE button on AO2000PR toolbar (it has an IE icon), and after your confirmation, the password will be changed to “elcom” (without quotes). Now you can log on into Content Advisor using that password, and change it to your own one (or remove the password protection completely, or disable the Advisor).


VBA backdoor

If you have a document with password-protected VBA project, but for some reason the password cannot be recovered, or the password shown by AO2000PR cannot be entered (e.g. it contains non-English characters that cannot be entered using your keyboard), or AO2000PR only allows to change or remove that password (but you would not like to do that), you can use the VBA backdoor feature. It works for all applications which can create VBA projects in their documents, not only MS Office.

With that feature, the password is not being recovered at all. However, you’re able to open VBA project (to view/edit the code); of course, you should have the application (this document has been created with) installed.

Just press VBA button on AO2000PR toolbar (next to IE button). The program will prompt you for the document file; select one, and AO2000PR will run the application (with a special way) this document has been created with, and load your document into it. Now go into VBA properties (typically, it is under Tools | Macro | Visual Basic Editor; Tools | VBAProject Properties; you’ll be prompted for the password. Enter ANY one (e.g/., xyz), and it will be accepted! If your document is from Microsoft Office 97, you can use Office 2000, too.

Please note that this backdoor is supported only for a limited number of versions of VBA engine (VBE.DLL or VBE6.DLL) – the ones that were available when current version of AO2000PR has been released (up to Office 2000 Service Pack 2). When the application is executed, AO2000PR prints (into the status Window) the size and version number of that DLL. If your one is not supported yet, please let us know the size and version number, and we’ll add the support for it to the future versions of AO2000PR.


Creating the project

If you need to recover the “open” password for Word/Excel 97/2000 document, you have to create a project first. Project file contains all information about the source file, selected options and character set. It is based on the Word/Excel document file.

When the program starts, it creates a new project automatically. Also, you can create a project by pressing the Create a new project button or selecting the Project | New menu item. Project can not be created for MS Access document, because recovering process doesn't require a long time.


Saving your project

When the file is loaded, you can save your project -- all the changes you've made will be reflected in the project file; the name for the project is selected automatically based on the name of the file; if you want to give an alternative name – use Project | Save as... menu item. If you don't want to change the name, just use the Save project button or Project | Save menu item. You can not save a project when Access file is loaded.


Type of attack

Brute-force or dictionary attack. Brute-force, Mask and Dictionary attacks are available. A brute-force attack will try

all possible passwords in specified range; if you remember a part of password, you can use a brute-force with mask attack. A dictionary attack verifies the words stored in specified dictionary file. The dictionary is just the text (ASCII file) with one work at a line; the lines are separated with line breaks. A dictionary attack is faster, and so we recommend to run it first; only if it fails, perform a brute-force attack.


Brute-force range options

In Office 97/2000 documents, passwords may contain the following characters: latin letters (both small and capital), digits, special symbols (like @, #, $ etc) and national languages symbols. You can select these ranges separately, or define your own password range. To define your own range, check the box Custom charset, press the Custom charset… button, and enter all characters you think the password may consist of. You can load, save and insert your defined character sets, using appropriate buttons in User defined charset dialog.

The special characters are:

!@#$%^&*()_+-=<>,./?[]{}~:;`'|"\


Start from password

This option may help, for example, if you know the first character(s) of the password. For example, if you're sure that the small letters have been used (from 'a' to 'z'), the length is 5, and the password definitely starts with 'k', than type 'kaaaa' here. Please also note, that if you press the Stop button when AO2000PR is working, the program writes the current password to this window (Start from password). It can be used later to restart the program from the same point.

Please note that the program verifies the passwords according to the following character order:

•	CAPITAL letters: 'A'..'Z'

•	the space

•	small letters: 'a'..'z')

•	digits: '0'..'9'

•	special characters: !@#$%^&*()_+-=<>,./?[]{}~:;`'|"\


Password mask

If you already know some characters in the password, you can specify the mask to decrease the total number of passwords to be verified. At the moment, you can set the mask only for fixed-length passwords, but doing this can still help.

For example, you know that the password contains 8 characters, starts with ‘x’, and ends with ‘99’; the other symbols are small or capital letters. So, the mask to be set is “x?????99”, and the charset has to be set to All caps and All small. With such options, the total number of the passwords that AO2000PR will try will be the same as if you’re working with 5-character passwords which don’t contain digits; it is much less than if the length were set to 8 and the All Printable option were selected. In the above example, the ‘?’ chars indicate the unknown symbols.

If you know that the password contains an occurrence of the mask character ‘?’, you can choose a different mask character to avoid having one character, ‘?’, represent both an unknown pattern position and a known character.  In this case, you could change the mask symbol from ‘?’ to, for example, ‘#’ or ‘*’, and use a mask pattern of "x######?" (for mask symbol '#') or "x******?" (for mask symbol '*').


Password length

This is one of the most important options affecting checking time. You can check all 4-character (and shorter) passwords in a few minutes; but for longer passwords, you have to have patience and/or some knowledge about the password (including the character set which has been used, or even better – the mask).

The minimum length cannot be set to a value greater than maximum length, of course.

If the minimum and maximum lengths are not the same, the program tries the shorter passwords first. For example, if you set minimum=3 and maximum=7, the program will start from 3-character passwords, then try 4-character ones and so on -- up to 7. While AO2000PR is running, it shows the current password length, as well as the current password, average speed, elapsed and remaining time, and total and processed number of passwords (Program status).  All of this information except average speed and elapsed time, which are global, is related only to the current length.


Dictionary options

Simply select the desired dictionary file here. In that attack, the program will try all words from it as passwords for the selected document. It really helps when the password has some meaning, i.e. the whole word. You can select an option Smart mutations or Try all possible upper/lower case combinations – it may really help if you're not sure about the register the password has been typed in. For example, let's assume that the next word in dictionary is «PASSword» (the case, actually, doesn't matter here). With the second option enabled, the program will just try all possible combinations, like:

password

passworD

passwoRd

passwoRD

passwOrd

…

PASSWORd

PASSWORD

However, checking all such combinations takes a lot of time: in the example above, the program will check 2^8 words (i.e. 256) instead of one. With smart mutations, you can eliminate a number of “virtually impossible” combinations, and here are all the words which will be checked:

PASSword	(as is)
passWORD	(reversed)
password	(all lower case)
PASSWORD	(all upper case)
Password	(first uppercase, rest lowercase)
pASSWORD	(first lower case, rest uppercase)
PaSSWoRD	(elite: vowels in lc, others in uc)
pAsswOrd	(noelite)
PaSsWoRd	(alt/1)
pAsSwOrD	(alt/2)

So, it makes only 10 combinations for each word.

The Start line # option allows you to start an attack from a given line (in dictionary); if you’ll interrupt the attack, the “current” line number will be written there (and saved to the project file, of course).

One really effective dictionary is included into AO2000PR distribution: english.dic (about 250,000 words). Some other very good ones are available at:

ftp://ftp.cerias.purdue.edu/pub/dict/

ftp://ftp.ox.ac.uk/pub/wordlists/

ftp://ftp.funet.fi/pub/unix/security/dictionaries/


Auto-save

If you'd like AO2000PR to save its state periodically, please check the appropriate option, and select the time (in minutes) between saves. If you do that, AO2000PR will periodically update a project file – exactly as if you press the Save project button yourself. Even if your computer stops responding (or if power fails), you'll be able to restore breaking the password from the last saved state. Enabling this option is strongly recommended.


Other options

If you'll select the Minimize to tray option, the program will hide itself from the screen when being minimized (so you will not see an appropriate button on Windows toolbar), but small icon will be created in the tray (near the system tray). Double-click on it to restore.

The Make backup before file changing option is for Access databases only -- if it is enabled and you change or remove the password, an original file (with the password) will be saved with "bak" extension. It is highly recommended to have this option enabled! And don't delete the backup file until you open the (updated) file in Access and can see that everything is fine.

By disabling the Prompt if project was changed option, you instruct AO2000PR not to display the messages like "The project has been changed. Save?", when you've changed some options and open an another project, or creating a new one.

The Progress bar update interval option allows you to set how often the program will update the progress bar and display the password which is currently verified. Higher value will give you slightly better speed; the recommended one is 500 (milliseconds). If the interval is set to 0, the progress bar will not be updated at all (but you still will be able to stop the process, of course, and resume from that point later).

Log file option instructs the program to write all messages (the same as in Status window) to the ao2000pr.log file – for future analysis.


Benchmark

Just press the Calculate button to get the speed of your computer on Word/Excel 97/2000 “open” password recovery. Having that figure, you can estimate the time you’ll need to recover the password (by dividing the total number of passwords to that speed). And the total number of passwords is just the number of characters in selected character set in a power of password length.


Recovery process

When all of the options are selected, all you have to do is to press the Start button on the toolbar and wait. During the attack, you’ll be able to see the Program status.

Please note that you can stop the recovering process at any time (Stop button), to continue it later (or just save the project). Consult the Start from password chapter for further details.


Program status

All program steps and results are displayed in the Status window.  The contents of the Status window is also saved into the ao2000pr.log file for future analysis (if appropriate option is selected).

If you want to see more information (current speed, total and remaining number of passwords, remaining time etc), open the "Extended statistics" window (before starting the attack, or when the recovery process is in progress).


The password is
The password is…

When (if) the password is found, the program shows it, as well as the number of passwords, which have been tested, and the program speed:

The last line displays the password in HEX (Unicode) form – it might be useful if the password, for example, contains some non-English characters, which cannot be displayed correctly in your system (due to missing fonts, etc.).

Pressing the small button at the right of the password (in “normal” or Unicode form) copy the password into the Clipboard. Alternatively, you can save the password to a file.

If all possible passwords in the given range have been tried without success (without finding a valid one), the message looks like:

If you stopped recovery by pressing the "Stop" button, the current step of the brute-force attack is saved in the "Start from" field. Now you can press the "Start" button again.  Recovery will be continued from this step.


Contacting us

For technical support, please contact us at support@elcomsoft.com. In the subject of your mail, please write AO2000PR x.y (where x.y is the version number), followed by problem, suggestion or whatever else.


Where to get the latest version

The latest version of AO2000PR is always available from our web page at http://www.elcomsoft.com/ao2000pr.html. Other password recovery products (for ZIP, ARJ, RAR and ACE archives; old versions of Microsoft Office; VBA projects in MS Office documents; MS Outlook, MS Backup, MS Money, MS Project; Lotus Organizer, Lotus 1-2-3, Lotus WordPro, Lotus Approach; Symantec ACT!, Borland/Corel Paradox, Corel WordPerfect, Intuit Quicken and QuickBooks, Adobe Acrobat PDF, email clients, instant messengers) are available from our site at http://www.elcomsoft.com/prs.html.


Copyright and license

•	All copyrights to AO2000PR are exclusively owned by ElcomSoft Co.Ltd.

•	Anyone may use this software during a test period of 30 days. Following this test period of 30 days or less, if you wish to continue to use AO2000PR, you MUST register.

•	Once registered, the user is granted a non-exclusive license to use AO2000PR on one computer (i.e. a single CPU) at a time.  The registered AO2000PR software may not be rented or leased but may be permanently transferred, if the person receiving it agrees to the terms of this license.  If the software is an update, the transfer must include the update and all previous versions.

•	The AO2000PR unregistered shareware version may be freely distributed provided the distribution package is not modified. No person or company may charge a fee for the distribution of AO2000PR without written permission from the copyright holder.

•	AO2000PR IS DISTRIBUTED "AS IS".  NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED.  YOU USE IT AT YOUR OWN RISK.  THE AUTHOR WILL NOT BE LIABLE FOR DATA LOSS, DAMAGES, LOSS OF PROFITS OR ANY OTHER KIND OF LOSS WHILE USING OR MISUSING THIS SOFTWARE.

•	You may not use, copy, emulate, clone, rent, lease, sell, modify, decompile, disassemble, otherwise reverse engineer, or transfer the licensed program, or any subset of the licensed program, except as provided for in this agreement.  Any such unauthorized use shall result in immediate and automatic termination of this license and may result in criminal and/or civil prosecution.

All rights not expressly granted here are reserved by ElcomSoft Co.Ltd.

•	Installing and using AO2000PR signifies acceptance of these terms and conditions of the license.

•	If you do not agree with the terms of this license you must remove AO2000PR files from your storage devices and cease to use the product.


Registration

You can get a fully functional version of AO2000PR at a cost of $60 (standard edition, personal license) or $120 (standard edition, business license) or $150 (professional edition). With the personal license, you can use the program for non-commercial purposes in non-business, non commercial environment. To use the program in a corporate, government or business environment, you should purchase a commercial license. Registering makes your copy legal and helps support our efforts to continually develop innovative products to best serve your needs. Registered users are entitled to free technical support and free updates/upgrades.

Select one of the following ways:

•	Through the World Wide Web. This is the fastest and easiest way. Your credit card information is sent directly to the credit card processor in a very secure manner, so that nobody else can see it. For details on ordering AO2000PR through the Web, please go to the AO2000PR page at http://www.elcomsoft.com/ao2000pr.html and follow the link Order the Fully Licensed Version of AO2000PR. Or, you can go directly to the order pages:

https://www.regnow.com/softsell/nph-softsell.cgi?item=1170-66 (standard edition)

https://www.regnow.com/softsell/nph-softsell.cgi?item=1170-68 (professional edition)

•	You can also register the program by sending us the purchase order, or money order, or cheque – look at the order form ("order.frm"). Phone and fax orders are accepted as well. Please don't send cash to our mailing address.

•	We do accept wire transfers to our bank account. Please contact our order department (orders@regnow.com) asking for the invoice for product 1170-66 (standard edition, personal license), 1170-67 (standard edition, business license), or 1170-68 (professional edition). You'll be charged for extra $10, however (bank fees).

On payment approval (usually, in a few minutes after you'll register – for online orders), we'll send you the registration key which will remove all limitations of unregistered version, such as maximum password length. Your registration will be valid for all future versions of AO2000PR.

If you will not get your registration key within a reasonable amount of time (two business days for credit card payments or two weeks for other payments), please notify us about that! We're very sorry for any inconvenience caused by those delays.


Limitations of unregistered version

An unregistered version of AO2000PR has the following limitations:

•	for brute-force and mask attacks (Word/Excel 97/2000), the maximum password length is limited to 4

•	some dictionary attack (Word/Excel 97/2000) options are disabled

•	passwords longer than 3 characters cannot be recovered (with the exceptions listed above)

•	Excel workbook and sheets passwords are not shown

•	log file is not created

•	VBA backdoor feature is not available

•	VBA passwords for Office 2000 documents cannot be changed/removed

•	Excel plugins (XLA) cannot be unlocked

•	Access database owner information (name and ID) is not shown