If you log in as a user with the ORA_DBA group, you will be able to get into your instance without a password. Usually the user on your machine that installed Oracle will work.
Just do this at a command prompt (after setting ORACLE_HOME and ORACLE_SID)
sqlplus "/ as sysdba"
Once you've done that, you can "alter user sys identified by xxxxx" to change the SYS password (replace xxxxx with the new one) and use the orapwd utility at the command line to change the password file.http://www.dba-oracle.com/concepts/setting_roles.htm
"If you intend to allow remote users to connect internal, you need to set the REMOTE_LOGIN_PASSWORDFILE option in your database parameter file to either EXCLUSIVE or SHARED. The user will then connect in server manager with the AS SYSDBA or AS SYSOPER clause at the end of the CONNECT command (CONNECT SYS AS SYSDBA). The privileges assigned to SYSDBA correspond to those for OSDBA. The privileges assigned to SYSOPER correspond to OSOPER. The operating system verifies the password provided using an external operating system file. This external file is generated using the ORAPWD utility. When the password for the INTERNAL or SYS accounts are changed with the ALTER USER command, the changes are mapped to the operating system password file. "