Don't know if this helps but I've tried loads of solutions and even with a custom password list the elcomsoft couldn't find any results. Some people have noted that it uses a random password frm passwords you've stored on your device so try your facebook password, email account, lock code etc. None worked for me.
After a few days of scouring forums I had to do it a convoluted way in the end.
I installed iFunbox and copied the keychain-2.db file to my PC after making a backup of it in the same directory on the iPhone (var/keychains)
I then deleted the file from my iPhone and reconnected it to iTunes. This meant all passwords had been deleted (albeit temporarily from my iPhone). I then selected the encrypted backup option again and started a backup then cancelled it which created a new keychain-2.db file in var/keychains. I then removed the encrypt option. This asked me for a password but it was set to the new password I'd just entered so the tick was then removed.
I then exported and opened the new keychain-2.db file in exported in sqllite browser (do a search and download it, it's free). I then opened my original file in sqllite browser. The reason I did it this way is because for some reason my keychain files displayed a load of gobble-di-gook in sqllite browser so I couldn't determine what was the itunes password. Maybe because I'm running iTunes 10.5 but people have previously stated that the files are shown in plain English but mine weren't.
I then compared the genp tables in sqllite browser until I found the record that had the same set of symbols in the acct column that as in the new keychain-2.db file I'd created as this would be the iTunes password I'd just created. No other records existed in the new keychain file.
I then deleted that record in sqllite browser, saved and imported back into var/keychains using iFunbox.
The encrypted option is no longer ticked and I can make unencrypted backups. I will definitely not be ticking that box again!!!
I know it sounds really long and laborious but if you follow it step by step it isn't as long as you think. I've no previous experience of this and I found all thge info from scouring various forums and piecing it all together to create my own solution. Also, if you're lucky enough to have your keychains file display as plain English in sqllite browser then you can just delete the record that says it is your itunes backup password.
Hope it makes sense. It really does work!