>Hi Jos,
>
>Incredible!!! It works!!! You're a sorcerer. ( grin )
>
>Can you explain to me how come that this little change can do the job?

I got this info from Xitech and the article below. Cryptor is contained in a packed file format. This is like ASPack, UPX and similar file packers. But when they released XICR50.dll they changed the packers name to "xitech". Windows will allow certain packers as known "ok" packers. It does not recognize "xitech" as a legitimate packer and hence does not trust it under DEP protection mode. You can read some more about this here:

http://blog.fabriceroux.com/index.php?blog=1&title=hardware_dep_has_a_backdoor&more=1&c=1&tb=1&pb=1

Also, I understand there will be a Cryptor 6 coming some time...