Antimalware, firewall, and other security programs for Windows XP working in 2023 and hopefully beyond

[tekkaman]

Does SuperAntispyware detect anything these days ? In the old days I used it to clean up computers. But later it would only detect cookies. It became a cookie muncher hahah

[Multibooter]

The "AutoPatches" for My Ancient Version of Kaspersky

I succeeded in updating both the application modules and the signatures of My Ancient Version of Kaspersky with a single combined update, without a license key and without activation. By installing the final AutoPatches, My Ancient Version of Kaspersky has been updated to the ultimate final version, with the most recent program file digitally signed OK 26May2014.

The screenshot above indicates the final AutoPatch "r" next to "Application version" and the Database release date "2/4/2026". Once knowing how-to, preparing future combined updates will be quite easy. The term "AutoPatches" by Kaspersky corresponds roughly to the term "Hotfix" by Microsoft.

 

The screenshot above indicates "Update completed successfully" and "Update application modules: Yes". The signature updates were from a Kaspersky Lab update server, the application updates ("AutoPatches") were from my personal archive. Signature updates and application updates ("AutoPatches") were combined into a single update folder.

 

The screenshot above indicates signatures of 2/4/2026 and the message: "Database status: Reboot is required". This message "Database status: Reboot is required" is displayed by My Ancient Version of Kaspersky when the update of the application modules via AutoPatches is pending. A tiny red square is added to the Kaspersky icon in the System Tray, indicating that AutoPatches are pending.

During the reboot after the update, the Kaspersky driver updates and installs the program files contained in the AutoPatches and updates the registry, completely hidden and invisible to the user. StartUp Organizer, for example, which I use as a watch dog, does NOT notice any changes before, during and after the reboot. After rebooting and AutoPatching, the Kaspersky icon in the System Tray looks normal again, without a tiny red square.

 

The successful installation of the AutoPatches is indicated in the About screen above by the display of "r" [=version of the AutoPatches] next to the Version (Note: the About screen is displayed by right-clicking on the Kaspersky icon in the System Tray -> About) and in the Support window (1st screenshot, at the top of this posting). Also, LastSuccessfulUpdate in the registry contains a hex value (Unix timestamp), which confirms that the update was successful. Furthermore, virus-checking with the updated application module and the new signatures works fine.

The installation of the final AutoPatches plus a signature update of My Ancient Version of Kaspersky had faced three challenges:
1) The files of the final AutoPatches were removed from the Kaspersky Lab update servers and are most likely not available anywhere in the internet.
2) Kaspersky Lab does not provide license keys for My Ancient Version of Kaspersky anymore, which would permit multiple updates. My Ancient Version of Kaspersky is an unexpiring trial version and can only be updated once. An initial update with the final AutoPatches followed by a second update with current signatures is therefore not possible. Only one update is possible, either an update of the signatures from the Kaspersky Lab server or an update of the application module from my personal archive, but not both..
3) The digital signature of the .xml file in the subfolder \index\ in the update folder impedes the combining of AutoPatches and current signatures into a single update folder.

Before August 2019 the online updates from Kaspersky Lab of My Ancient Version of Kaspersky had consisted of three sub-folders: \AutoPatches\, \bases\ and \index\. After August 2019 no sub-folder \AutoPatches\ is created when downloading updates.

The sub-folder \AutoPatches\ contained updates of the installed application modules, \bases\ contained the signature updates and \index\ contained only a .xml file validating \AutoPatches\ and \bases\. The .xml file in \index\ contains at the end a string which is an encoded digital signature generated using the private signing key of Kaspersky Lab. Changing text in the .xml file without updating the signature at the bottom will result in the error message "Invalid file signature" when trying to update.

The final release of December 2012 of My Ancient Version of Kaspersky had been updated by several sets of "AutoPatches" supported by Kaspersky until 2017, identified by a letter of the alphabet appended to the build number of Kaspersky Anti-Virus. The last AutoPatch for My Ancient Version of Kaspersky is "r" and contains for example an updated basegui.dll, digitally signed OK 26May2014.

The AutoPatches for My Ancient Version of Kaspersky were available from the Kaspersky Lab update servers until about 2018. When I tried to update in August 2019, all files of the AutoPatches for My Ancient Version of Kaspersky had been removed from the Kaspersky Lab update servers and My Ancient Version of Kaspersky could not be updated to release "r" (about 26May2014) anymore. The application modules of My Ancient Version of Kaspersky consequently remained those of the final release of December 2012, without any AutoPatches applied..

In addition Kaspersky Lab removed the text string which identified My Ancient Version of Kaspersky, from the digitally signed .xml file in \index\ downloaded from Kaspersky.

Kaspersky Lab must have decided by August 2019 to definitely stop supporting My Ancient Version of Kaspersky, because they removed the application update files from their update servers and made it generally impossible to update the program with AutoPatches by removing the string permitting updates of My Ancient Version of Kaspersky from the digitally signed .xml in \index\.

The final AutoPatches, including "r", probably also improve the Protection Components of My Ancient Version of Kaspersky. I have used My Ancient Version of Kaspersky only as an on-demand scanner, I have no need for the Protection Components. Nevertheless, I may eventually add the Protection Components to the installation, for further testing and to see whether activation is required to get the Protection Components to work. According to the User Guide of My Ancient Version of Kaspersky, if you select "Activate later" after installation, "you will have access to all the application's features, except for updates (only one application update will be available)".

Edited February 8 by Multibooter

[FelixPls1]

why are you censoring the version number?

[Multibooter]

37 minutes ago, FelixPls1 said:

why are you censoring the version number?

To avoid actions by Kaspersky blocking my occasional updates. The size of each update is about 800MB traffic and Kaspersky has to pay for the traffic. I assume that they are already in a difficult financial position because of the US embargo. If they survive I assume that My Ancient Version of Kaspersky will still get free, current signature updates in 2030.

Edited February 8 by Multibooter

[Karla Sleutel]

6 hours ago, Multibooter said:

because of the US embargo

Then you need to promptly delete everything you posted about the unlawful programme and start to obey your government. Probably, it's the right time to consult a lawyer.

USA citizens - they do need to obey sanctions.

"All U.S. citizens and permanent residents must comply with U.S. sanctions, regardless of their location. This includes individuals and entities within the United States and U.S. incorporated entities and their foreign branches."

It's against the law, what you do! See the links.

https://ofac.treasury.gov/faqs/11

https://www.sgrlaw.com/ttl-articles/860/

[NotHereToPlayGames]

I wish it were "that easy".

Sure, I'll comply to every "US Sanction" I am legally obliged to comply with, but the average person doesn't know about these sanctions.
Even if I'm only complying because I can't "not" comply.  Sanctions against France, the local wine aisle clears a shelf.
I can't buy the wine not because I am complying with a sanction, but because the store is fined if they sell it, so they take it off the shelf.
Might be weeks or months before the news hits the public and we finally find out WHY we can no longer buy French wine.

It's kind of like my utility bill, there's a note on it that reads, (paraphrasing) "This amount is due whether you recieve this invoice or not."
Or speeding, whether there is a sign posted or not, you cannot drive 120mph in a school zone just because it's the summer and no kids are in school.

‘Ignorance of the law excuses no man; not that all men know the law, but because ’tis an excuse every man will plead, and no man can tell how to refute him.’
– John Selden (17th-century English jurist)

Look into immigration and ICE protests here in the USA and please tell me if that can be summed up in a neat and nice one-liner about complying with US "laws".

"Mob Mentality" is probably very different from one country to the next.  And to what "cause" the Mob steps in.

Edited February 8 by NotHereToPlayGames

[Multibooter]

6 hours ago, Karla Sleutel said:

Then you need to promptly delete everything you posted about the unlawful programme and start to obey your government.

Unapplicable legal snippets. msfn.org is an international forum, not a USA forum. My Ancient Version of Kaspersky is definitely not an unlawful program for me or for the great majority here at msfn.org.

Why don't you wear a head scarf in your msfn.org picture, to obey Iranian Islamic Law, to avoid offending strict Moslems?

Maybe you should tell your fellow Canadians to stop travelling to Cuba in winter, because U.S. laws declare tourism to Cuba as illegal.

There are good laws and bad laws. Would you have obeyed in 1935, as a good Canadian,  the German Nuremburg Laws https://en.wikipedia.org/wiki/Nuremberg_Laws and betrayed Jews to German concentration camps?

Would you have obeyed in 1964, as a good Canadian, the United States Jim Crow laws https://en.wikipedia.org/wiki/Jim_Crow_laws ordaining racial segregation and racial discrimination?

There is no need to commiserate here with the lack of freedom of U.S. subjects. This is an international technical forum. Hopefully, U.S. subjects will eventually get their freedom back. And no more unapplicable legal advice from a U.S. fifth column in Canada.

Edited February 8 by Multibooter

[Dave-H]

We all know where this is going to go.
Please get back on topic.
 

[Multibooter]

19 hours ago, Multibooter said:

The installation of the final AutoPatches plus a signature update of My Ancient Version of Kaspersky had faced three challenges:

1) The files of the final AutoPatches were removed from the Kaspersky Lab update servers and are most likely not available anywhere in the internet.

I did find a site which had links to many downloads of AutoPatches: https://filemood.com/result?q=autopatches

Unfortunately, there were no AutoPatches for my Ancient Version of Kaspersky and the download links are dead bittorrent magnet links. Kaspersky Lab has 30+ products with signature updates, with different versions etc, so the chance is exceedingly small that the relevant AutoPatches are still available anywhere in the internet. Maybe in archives of corporate users of Kaspersky of 10+ years ago, although I doubt that corporations archive old stuff that long.

OT: When I looked into my own personal archive I have found an AutoPatch containing avp.exe v6.0.3.851 for the last version of Kaspersky Anti-Virus for Windows 98. klif.sys in this newly-found AutoPatch is digitally signed OK 1Apr2009. I had previously thought that Kaspersky Anti-Virus v6.0.3.844 (28Apr2008) was the last version for Windows 98, but this newly-found AutoPatch may update the last Win98-compatible build of Kaspersky Anti-Virus even further. This AutoPatch seems to be a major final update, it contains 27 files. What confuses the matter is that this newly-found AutoPatch was in a sub-folder \6.0.3.830\ with a lower version number than Kaspersky Anti-Virus v6.0.3.844 (28Apr2008) for Windows 98. Eventually I will have to check whether this newly-found AutoPatch can be installed under Win98 and whether the resulting ultimate final build for Win98 can be updated with current signatures. 

Edited February 8 by Multibooter

[Multibooter]

4 hours ago, Multibooter said:

Eventually I will have to check whether this newly-found AutoPatch can be installed under Win98 and whether the resulting ultimate final build for Win98 can be updated with current signatures. 

OT: I made a preliminary, quick test under Win98. I test-installed under Win98 a slightly earlier version, Kaspersky Anti-Virus v6.0.3.837 Workstation (MP3, 25Feb2009), then attempted to update using this newly-found AutoPatch. It did not work v6.0.3 requires different folder names in the update folder. I also got the error message: "License verification failed" when I tried to update. Maybe v6.0.3 does not have a free 1st update, in contrast to My Ancient Version of Kaspersky, I don't remember. 10+ years ago I had a valid license, now expired long ago, so I didn't have the issue "License verification failed".

Summary: it didn't work but maybe I will look into it again, much later.

Edited February 8 by Multibooter

[Guest MatthewH16]

I found a working client, though it needs further testing. ESET NOD32 Antivirus v8.0.319.1, with a modified update server (http://easynod.servebeer.com/) updates to latest 2026 virus definitions. I can't link to where I found this information, but it is out there

Edit: it also works on Win 7 64bit.

Edited February 15 by MatthewH16

[genieautravail]

On 2/15/2026 at 5:24 AM, MatthewH16 said:

I found a working client, though it needs further testing. ESET NOD32 Antivirus v8.0.319.1, with a modified update server (http://easynod.servebeer.com/) updates to latest 2026 virus definitions. I can't link to where I found this information, but it is out there

Thank you for the informations. 

and YES, the virus signature database is updated and works. 

Below a link for downloading the command line scanner with the updated virus signature database.

These files are included in the installation folder of ESET NOD32 Antivirus 8.0.319.1.

This command line tool is free to use (don't require a licence key):

https://buzzheavier.com/u1kpplyt2fh0

Edited February 16 by genieautravail

[Multibooter]

Kaspersky Rescue Disk 10 CD of 22Feb2013 with signatures updated to 7Mar2026
I have created an updated Kaspersky Rescue Disk 10 CD from:
- a Kaspersky Rescue Disk 10 .iso of 22Feb2013
- signature updates of 7Mar2026. The signature updates were obtained under Windows XP from an update folder, updated by Kaspersky Updater (separate program). In my case, the update folder for My Ancient Version of Kaspersky was used.
Creating such an updated CD is a little tricky. Updates of Kaspersky Rescue Disk 10 are usually stored separately on a HDD etc of the computer, not on the burnt CD. The updated Kaspersky Rescue Disk 10 CD has worked fine for me.

The 4 red arrows in the screenshot above point to the following:
- "Start update: Never started" indicates that all signatures are on the bootable CD, not on a HDD etc of the computer
- "Database release date: 3/7/26"[=7Mar2026, with 17,183,627 signatures] indicates that the current signatures, obtained with Kaspersky Updater,
   were correctly incorporated into the updated .iso/CD
- "Kaspersky Rescue Disk version 10.0.32.17" in the About screeen indicates that the program components were correctly incorporated into the updated .iso/CD
- "Kaspersky Registry Editor" is a Linux-based registry editor to view or edit WinXP, Win2003, etc registries simultaneously,
   as when multiple operating systems are installed on a computer (multi-booting)

Kaspersky Rescue Disk 10 of 22Feb2013 is safe to use
The Russo-Ukrainian war started on 27Feb2014 https://en.wikipedia.org/wiki/Russian_occupation_of_Crimea
Kaspersky software released before this date (27Feb2014) is most likely safe, Kaspersky software released after that date may or may not be safe.
"These are not new concerns; going back to 2015 Kaspersky has been at odds with the US government"
https://www.majorgeeks.com/news/story/kaspersky_banned_in_the_usa_what_you_need_to_know.html
The program components of the updated Kaspersky Rescue Disk 10 CD were created more than a year BEFORE 27Feb2014 and are therefore, in my opinion, safe to use.

The screenshot above of the Kaspersky Registry Editor, also on the Kaspersky Rescue Disk, shows the registries of the Win2003, WinXP SP2 and WinXP SP3 operating systems installed on my 25-year-old, 650MHz Pentium III Inspiron 7500 laptop. The Kaspersky Registry Editor cannot access or display the registry of the Windows 98SE operating system, also installed on the laptop.

Kaspersky Rescue Disk 10 is freeware. Feel free to contact me in case of interest, as for testing or reviewing the updated CD, without having to access the Kaspersky Lab servers.

Edited March 8 by Multibooter

[Dave-H]

Registry recovery discussion moved here.

[tekkaman]

On 2/15/2026 at 12:24 AM, MatthewH16 said:

I found a working client, though it needs further testing. ESET NOD32 Antivirus v8.0.319.1, with a modified update server (http://easynod.servebeer.com/) updates to latest 2026 virus definitions. I can't link to where I found this information, but it is out there

Edit: it also works on Win 7 64bit.

I remember using Eset Nod32 and fighting with different update servers to keep it running. I wonder how long this one will last.