Which of the following tools is spyware that makes Windows clients send their passwords as clear text?

C2MYAZZ is a well-known piece of spyware that modifies a specific registry key on Windows clients: HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword. By setting the value of this key to 1, it reconfigures the system's SMB redirector (the LanmanWorkstation service) to permit the sending of passwords in clear text. When the compromised client attempts to connect to a malicious SMB server that requests plaintext authentication, the client will comply, exposing the user's credentials to network sniffing.

A. Pwddump2: This tool is used to extract LM and NTLM password hashes from the Security Account Manager (SAM) database on a local or remote Windows system; it does not transmit clear-text passwords.
B. SMBRelay: This tool performs an SMB relay attack by intercepting and forwarding NTLM authentication challenges and responses between a client and a server, but it does not cause the client to send clear-text passwords.
C. KrbCrack: This is an offline password cracking tool designed to break encrypted Kerberos ticket data that has been captured from the network to recover a user's password.

1. Microsoft Corporation. (n.d.). MS-SMB: Appendix A: Product Behavior. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-smb/62963755--494d-8673-a858a02070a3. In section 3.2.4.2.4

the documentation discusses the EnablePlainTextPassword registry control

stating

"If this registry key is set to 1

the client MUST support the SMBFLAGS2SECURITYSIGNATURES flag being clear in an SMBCOMNEGOTIATE Server Response... and send a plaintext password." This confirms the mechanism used by C2MYAZZ.

2. Purdue University. (2004). Lecture 18: Windows NT/2000/XP Security. CS 42600: Computer Security Courseware. Retrieved from https://www.cs.purdue.edu/homes/ninghui/courses/426Fall04/lectures/Lecture18.pdf. On slide 22

under "Password Cracking

" the lecture notes explicitly mention "C2MYAZZ.exe" as a Trojan that "sets registry to allow sending plain-text passwords."

3. Scambray

J.

McClure

S.

& Kurtz

G. (2001). Hacking Exposed: Network Security Secrets & Solutions (3rd ed.). McGraw-Hill/Osborne. While a commercial book

its use in university curricula is well-documented. Chapter 5

"Windows NT/2000/XP

" details the attack

explaining that tools like C2MYAZZ modify the EnablePlainTextPassword registry value to enable sniffing of cleartext LAN Manager authentication. This historical context is widely cited in academic security courses.