Skype has a web page for password recovery. It simply asks for the user name and email address. It’s obvious that the person has the user name, or there’s nothing to recover. But the user might not have the email address, and that’s a common problem.

Skype stores the email address that was used when the user registered. It’s in %app data%\skype\skypeusername\profilennnn.dbb. The skype user name would have to be plugged in, and I don’t know how to figure out the number, except there’s only one dbb file in that directory with a name starting with profile.

Searching that file for the email address, which is preceded by an @ sign and followed by x00. Of course, a person could find the file manually, open it with a text editor, and read it, but a tool would be almost trivial to write.

Once the user has the email address, assuming it’s valid and the email goes to the user, recovery is trivial.

The other thing is MD5 encoding. From what I read on this website. it should be trivial to write something to encode the password and end up with something that matches what is stored locally. Users often have an idea of what they might have used, such as words, letters, or numbers that they typically use. A user might be able to make a list of a dozen or so possible passwords, and a program could tell easily when they had a match.

Alternatively, rather than generating random passwords and using brute force, a user could supply parameters. If my name is John Smith and I work for Acme, have three children whose ages I sometimes use in passwords, and whose wife’s name is Agnes, I might want to be able to supply a dozen keywords, such as my name, kids names, etc. A program could try various combinations in different orders, with and without embedded numbers. I might know that I typically use numbers at the end, or that I want to limit numbers to 1 or 2 digits.

In a nutshell, a user might be able to come up with enough keywords and parameters to enable a relatively simple algorithm to find the password in less than a few seconds.

If you can still login into kiwipk9393@aim.com without entering your password there is still a chance you can recover it. Just download AIM Password Recovery, install it, run it and see if it finds any passwords.

Download link:
http://www.reactive-software.com/aim-password-recovery.html

I hope this helps,
Eugene