First off, your images are too damn small to see anything. Second, looks like something got screwed up in the was it encrypts/decrypts the passwords. You're saying it happens when they log in, so chances are the decryption routine has been messed with somehow. Judging by what I can actually make out of the second image, the key being passed to the function is blank or unset. Right click that function and click "Find all references." and find the one passing a nulled string to the function.