>In order to make VFP's typically enormous EXE files a bit easier to download, we are using Winzip.

This works only if you set encrypt off in the project options

>The trouble is, we also do not want our software falling in to the wrong hands and being decompiled with REFOX. To avoid this, we bought a copy of REFOX and branded our software ourselves.

Don't forget that there are password removers for software encrypted with ReFox

>This works great, except that now when we zip up the files with WinZip we get 0% compression rate on the REFOX-ed files.

That's because Refox encrypts the file

>So what can I do? Can I use another zipping tool or another source-protection tool, or am I stuck with customers downloading massive EXEs?

If they can decompile it that doesn't say the can understand it.
If you don't include debug info they don't have the comments.
So it will take a while before they understand what you've done.
ReFox also isn't 100% sure in decompiling the file.

I don't think another zipping tool will help you. if there are not alike strings in your file (as in not encrypted files) a zipping tool can't do anything.

At this moment i don't know about other source protection tools, but if there are some, i think that there are crackers for them too.

So, if you want to make it as dificult as can be for a cracker you are stuck with customers downloading massive EXE's

Another thing you can do is excluding your Class librarys from your project.
Write a routine that compiles them all, copy them to anothere map, and then remove the source code out of it.
You could also think about other ways of splitting your exe into several parts.
Then your users only have to download the changed parts.