My env is Windows 2000,Oracle 9.2.
I tried to change password user sys with command
Command completed succesfully.
After that,i tried connection as user sys (as sysdba) with new password(succesfully),
but also with old password succesfully.In both situation I can do everything,no metter is it new or old password.
Without "as sysdba" Oracle server can recognize invalid username/password
I tried same action with user SYSTEM-same result.
I also tried to shutdown instance,after startup same thing.

Is anybody has any good idea?
I would be very happy.