[kh99]

I believe passwords are already encrypted using md5 twice, although salt is only included the second time. As far as changing how it works, you'd have to find everywhere the password is handled and change it. There's verify_authentication() in includes/functions_login.php and code which sets/updates the password in profile.php and register.php. There may be other places I don't know about.

I'm wondering though, for passwords to be cracked via PasswordPro you'd need the hashed version. Where are the "crackers" getting this? Maybe I'm missing something, but it seems like a more productive approach would be to address that.