Concerning the first question:

That problem is solved by the two versions of the dlls. Being the developer, you take the "_dev.dll" with the encrypt and decrypt functions. You can write the password.txt file with easy call of them.
Now, in the release version, you only include the ->release.dll without these ones (especially the decrypt function).

The "hacker" only can view the uncrypted string in your main.wdl and doesn't have the possibility to write a password.txt file (because he/she only has the release version).

The only problem is that the "hacker" could copy your .zip file AND your release.dll and than has access to the data ingame. But it would be a very unconfortable way, he/she would have to call a function that creates the model out of the working space to another folder.
But the real .zip password wouldn't be shown at all.

@second string:
At the mom I don't have time to develope it. Maybe anotherone is able to? The source code is posted already..

Regards
Sinthoras