What's the best way to get a stored POP3 password out of Outlook 2007?

Question

If you have a password for a POP3 account in Outlook 2007 (Windows 7 Home Premium) and you then forget the password, how do you retrieve it?

I tried copy-and-paste. No go.

I downloaded Mail PassView, but upon installing it, AVG said it was malware, so I removed it.

I eventually found the account details by opening up RegEdit, and found it in HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ (...) but it was encoded in REG_BINARY. I Googled around and found various Visual Basic routines for decoding it but being a Unix dork I had absolutely no idea what to do with said scripts.

By this point, I gave up and managed to get hold of the password by another means (it was written down on a piece of paper in the briefcase of the owner of the account - I know, it makes the inner sysadmin rage). I also attempted to write a simple POP3 server in Python and then get Outlook to log on to it, but that didn't really work out (it was about 4am at that point).

For future reference, is there an easy and sensible way of doing this? Is Mail PassView actually evil spyware or was AVG just giving me a false positive? (Any chance of Windows 8 having something like OS X's Keychain?)

Solution 1

AntiVir doesn't report anything on MailPV, so I think it's safe. Also, the developer already covered that topic in his blog.

To be absolutely sure, you can run it through VirusTotal.

Solution 2

If all else fails, then using a packet analyzer (network sniffer) like Wireshark will show passwords if these are not encrypted. Just be sure to filter on pop.request, or ensure no other applications are running that flood the logs.

Solution 3

I am a big fan of a couple of Nirsoft.net utilities for this type of thing. In particular:

• Password Sniffer - grabs unencrypted passwords from POP3, HTTP, etc.
• Smart Sniff - captures packets without the need to in WinPCap.

Comments

[phbelov]

Yes. Literally, it's copying the password field from a POP3 account in Account Settings. I could have reset the password. In this specific case, resetting the password would have meant calling the sysadmin in the middle of the night.

[phbelov]

Looks like Mail PassView is the answer then. Thanks!