First, are you you using perl anywhere? VB is slightly OT for perlmonks... ;-)

I'm no cryptologist, but XOR IIRC is not secure (as you mentioned). I doubt that VB out of the box has modules to do real en|decryption. Is it a possibility for your client to purchase a third-party extension that can do "real" encryption? I'm making the assumption that they do exist.

FTP is not secure in that the username & password are sent in cleartext when making the connection. Some other options are tunneling the communications channel (FTP uses 2 channels - 1 for the communications between the two machines and another for transfering the actual data) over SSH. I've used this method successfully. Another option is scp or rsync. I know there are Win32 binaries for rsync, but I'm not sure about scp. Both of these programs can communicate over SSH, so they are as secure as your SSH setup. HTH.

Updated: Just wanted to yank your chain about the perl talexb. :-)