I'm using Oracle 9i R2 installed on Windows XP Professional as a standard version.

I made a Password file like the below:

orapwd file="d:\oracle\amr\dbs\orapwd" password=admin entries=10

and then granted the SYSDBA permissions to user "HR". (GRANT SYSDBA TO HR;)

The value of "remote_login_passwordfile" in my PFile was "ESCLUSIVE" and also I was not connecting from a remote client.

So I could login to SQL *Plus like this:
connect HR/admin@TST as sysdba;

and everything was fine.

but, after that I removed the password file, revoke the sysdba permission from HR and changed the "remote_login_passwordfile" to SHARED, but still I could connect to the DB using HR as sysdba. (don't forget that I'm not connecting from a remote client)

I have even restarted the Instance.

----->
If the OS user you are logged in is member from the ORA_DBA group, then you will be allowed to connect from the local machine as SYSDBA. It's the way how the Oracle trusts the OS users.

If you comment out this line from sqlnet.ora file, you would get the desired effect:

SQLNET.AUTHENTICATION_SERVICES= (NTS)

----->
Also you may want to include the Oracle SID in the password file name for correct syntax:

orapwd file="d:\oracle\amr\dbs\orapwORCL" password=admin entries=10