Yes, strange...I tested it on my Win 2000 with 9.0.1 and got the same result. I can login with scott/tiger as SYSDBA even though scott is not included in the PWDFILE.

Could be a security hole in 9i? Chances are that we are just missing something though. I'll be interested in finding out though!