Antimalware, firewall, and other security programs for Windows XP working in 2023 and hopefully beyond

[AstroSkipper]

33 minutes ago, Tangy said:

@AstroSkipper Panda 21 is working without any problems what so ever, so far so good. I reckon it is the best choice ever. I do have Avast 18.5 but I would never go back to it. Kind of dodgy.

Thank you very much indeed !

It’s best not to celebrate just yet; wait until the PSANHost.exe process has been running stably again over the next few days or weeks. It may be stubbornly refusing to crash, but as we’ve learnt the hard way, this monster is capable of behaving quite differently.  Please report here if it crashes again! 

Edited 18 hours ago by AstroSkipper

[AstroSkipper]

Panda Dome 22.03.05 has been significantly more unstable on my primary Windows XP partition – which has all the POSReady 2009 updates installed – since 2 July than Panda Dome 21.01.00 on my secondary Windows XP partition, which does not have the POSReady 2009 updates installed. As the crashes were all related to the important system file ntdll.dll, I am now wondering whether the version of ntdll.dll also plays a role. This system file was installed with the POSReady update KB4493563 in March 2019, of course only on my primary Windows XP partition. Today, during a test of Glarysoft Malware Hunter, this programme also caused an error related to the ntdll.dll file. Coincidence? 

Edited 16 hours ago by AstroSkipper

[Dave-H]

2 hours ago, AstroSkipper said:

@Dave-H That's what I replied to @Tangy.

Thanks, sorry I'd forgotten that!
I've downloaded it ready in case I have to use it.

 

[AstroSkipper]

3 hours ago, AstroSkipper said:

It’s best not to celebrate just yet; wait until the PSANHost.exe process has been running stably again over the next few days or weeks. It may be stubbornly refusing to crash, but as we’ve learnt the hard way, this monster is capable of behaving quite differently.  Please report here if it crashes again! 

Somehow, I have a sixth sense. The PSANHost.exe process just crashed after running without errors for three days. Here is the error message and the contents of the PSANHost.exe.mdmp dump file extracted with WinDbg:

Quote

szAppName : PSANHost.exe     szAppVer : 20.3.0.0     
szModName : PSANModProcMon.dll     szModVer : 4.0.13.6     offset : 0004ff72

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

****************************************************************************

Loading Dump File [D:\Partition XPARBEIT\Berichte\Panda Dome 21.01.00\PSANHost.exe.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: SRV*C:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Wed Jul  8 11:43:54.000 2026 (GMT+2)
System Uptime: not available
Process Uptime: 0 days 1:19:39.000
................................................................
................................................................
................................................................
.......................................................
Loading unloaded module list
...............
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(9dc.1580): Access violation - code c0000005 (first/second chance not available)
eax=699102fe ebx=80070000 ecx=69901b8c edx=69901bc6 esi=00001a44 edi=00000000
eip=7c91e514 esp=10209f78 ebp=10209fdc iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
ntdll!KiFastSystemCallRet:
7c91e514 c3              ret

As I said, you shouldn't get your hopes up too soon. This time, it also has to do with the DLL file PSANModProcMon.dll. Maybe try turning off Process Monitor . I'm glad there's no Panda Dome on my primary Windows XP partition at the moment.
 

[AstroSkipper]

Well, folks, things are about to get tough. After restarting my Windows XP partition with Panda Dome 21.01.00, the PSANHost.exe process crashed again immediately - and this time it was a major crash. The main process, PSUAMain.exe, then froze completely. Nothing was working anymore. Here's some log and dump data:

Quote

szAppName : PSANHost.exe     szAppVer : 20.3.0.0     szModName : ntdll.dll     
szModVer : 5.1.2600.6055     offset : 00010cce     

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [D:\Partition XPARBEIT\Berichte\Panda Dome 21.01.00\WER36ce.dir00\PSANHost.exe.mdmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: SRV*C:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Thu Jul  9 01:09:50.000 2026 (GMT+2)
System Uptime: not available
Process Uptime: 0 days 0:01:37.000
................................................................
................................................................
................................................................
.....................................................
Loading unloaded module list
...........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(a9c.c90): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=80070000 ecx=c0000005 edx=00000000 esi=00000ca8 edi=00000000
eip=7c91e514 esp=03ba9ce4 ebp=03ba9d48 iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000297
ntdll!KiFastSystemCallRet:
7c91e514 c3              ret

And then things got even worse. A BSOD, caused by the Panda Network Filter Driver psinknc.sys. Here is the message and part of the dump file analysis:

Quote

Der Computer ist nach einem schwerwiegenden Fehler neu gestartet. Der Fehlercode war: 0x10000050 (0xb0f7ce34, 0x00000001, 0x806f2753, 0x00000000).

MODULE_NAME: psinknc

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  5fc700a7

.....

SYMBOL_NAME:  psinknc+a70b

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  psinknc.sys

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

After that, I tried to boot into safe mode, but I couldn't get in. Somehow, I managed to boot into the partition normally again, and I immediately uninstalled Panda Dome completely, including an additional deep clean. Forget about Panda Dome entirely, whether it's version 21.01.00 or 22.03.05! Since the 2. of July, Panda has destroyed compatibility with Windows XP and compromised it by faulty, incompatible updates. Currently, the following applies: Stay away from Panda on Windows XP!  Nothing works anymore without an official fix or patch.  That’s it for Panda as far as I’m concerned. I’m absolutely livid. 

P.S.: The minidump content is incomplete due to the totally faulty forum editor.   One can’t post sensibly here anymore. 

Edited 19 minutes ago by AstroSkipper

[Tangy]

@AstroSkipper Thank you for the warning mate. I managed to uninstall it without any dramas. Any suggestions ??

What is this all about then ?

https://www.pandasecurity.com/en/mediacenter/best-antivirus-for-windows-xp/

Dated 1 july 2026.

What about that 360 ? 

Cheers

Edited 9 hours ago by Tangy
add link

[modnar]

8 hours ago, AstroSkipper said:

...I’m absolutely livid. 

Yeah, that's what they're doing to us.

Anyhow - a few pieces of news:

a) with Panda installed going into WinXP SafeMode takes about 1 minute or maybe more (feature?) 

b) Panda 21.01 hasn't worked here either - same problems

c) Avast 18.5.2342 - now I know why it wants internet - because even if you choose manual update in "Program update" it will do it in the background (instup: their setup) and update to 18.8.2356 (18.8.4084.0 internally) and then wants you to restart. But then again we come to the csrss overloading, so - a non starter.

d) IOBit Malware fighter 11.4 works well and updates to july 2026 definitions.

e) Today I punched into Serpent search engine iobit malware fighter xp and there was also a find of sourceforge, so went there, downloaded it and it's a 12.5.0.1545 and it installs and works merrily on WinXP. I believe it's a keeper.

Edited 3 hours ago by modnar

[AstroSkipper]

9 hours ago, Tangy said:

@AstroSkipper Thank you for the warning mate. I managed to uninstall it without any dramas.

You’re welcome! It’s rare for me to be this blunt.  But what I went through last night was hell.  My entire partition was at risk. The BSOD had wiped out various files. Fortunately, most of them were related to Panda. It was a miracle that I was even able to boot the partition at all. And the fact that Panda could be uninstalled despite the damage was another one. Incidentally, the whole drama started straight after the nightly automatic update that Panda had carried out yet again. 

9 hours ago, Tangy said:

Any suggestions ??

What is this all about then ?

https://www.pandasecurity.com/en/mediacenter/best-antivirus-for-windows-xp/

Dated 1 july 2026.

What about that 360 ? 

I’m a bit reluctant to make recommendations these days, but I can tell you what I did a few days ago, in a moment of foresight. It’s really just a coincidence, but take a look at number 7 on the list you posted. That’s what I recently installed: VirIT eXplorer Lite. Here’s my post:
https://msfn.org/board/topic/184730-antimalware-firewall-and-other-security-programs-for-windows-xp-working-in-2023-and-hopefully-beyond/page/101/#findComment-1288687
This antimalware programme is very nice. It is fully compatible with Windows XP, even in the latest version. The Lite version is free of charge. If you want to have more protection, you have to buy a license for the Pro version. The programme interface isn’t modern; it’s got a bit of a retro feel to it. That’s what programmes looked like in the 1990s: extremely colourful, with lots of bright colours and plenty of colourful buttons. Personally, I think it’s brilliant. It reminds me of those days. VirIT eXplorer Lite requires very little RAM and CPU power. The virus definitions are downloaded locally to the computer and are therefore available offline. That’s the only reason why the programme folder takes up just over 500 MB. And support is available and active.  The intrusion detection shield, called VirIT Lite Monitor, had flagged processhacker.exe as malicious and issued a warning every time the computer started up. I then uploaded the file to VirIT or, to be more precise, to C.R.A.M., along with a message. A day later, the warning had disappeared, as they’d complied with my request to whitelist it. I’m completely satisfied with VirIT eXplorer Lite at the moment.  Another reassuring point is that this is a programme developed in Europe – specifically in Italy. I will soon be writing a detailed article about VirIT eXplorer Lite/Pro. 



Old screenshot of my VirIT Lite Monitor with false positive:



New screenshot with Process Hacker 2 whitelisted by C.R.A.M.:



Cheers, AstroSkipper 

Edited 1 hour ago by AstroSkipper

[AstroSkipper]

52 minutes ago, modnar said:

e) Today I punched into Serpent search engine iobit malware fighter xp and there was also a find of sourceforge, so went there, downloaded it and it's a 12.5.0.1545 and it installs and works merrily on WinXP. I believe it's a keeper.

Can you please provide this sourceforge link? I thought according to their website that 12.x versions were no longer compatible with Windows XP. 

Edited 2 hours ago by AstroSkipper

[modnar]

15 minutes ago, AstroSkipper said:

Can you please provide this sourceforge link? I thought according to their website that 12.x versions were no longer compatible with Windows XP. 

Here it is: https://sourceforge.net/app/iobit-malware-fighter/

[we3fan]

20 hours ago, AstroSkipper said:

Long time ago, I used COMODO Antivirus for a short time. It didn't convince me even back then and I uninstalled it. But COMODO Internet Security Premium 12.0.0.6818 was, in fact, the last version that was claimed in some forums to run flawlessly on Windows XP. So if this version doesn't work properly anymore, you can forget about COMODO as antivirus protection.

P.S.: I found this one here advertising the use under Windows XP: https://antivirus.comodo.com/security/free-antivirus-xp.php 

I see, Thanks.

I wonder if the problem I have with  COMODO Internet Security Premium 12.0.0.6818  is ON MY END because I have some problem with my current XP SP3
installation or maybe I am missing something (.NET Framework, Visual C++, or a KB update).
I will wait until at lease 1 person reports the same problem before I totally dismiss this version and delete the installer.
If a normal  Quick Scan  lasts more than 10 seconds they can stop the scan and that means it works for them and it doesn't work for me.
If a normal  Quick Scan  says 'Scan Aborted' after 1-3 seconds that means they are having the same problem as me, and this version REALLY has a
problem.

I wanted to see if the Scan is fast or slow, and in case it finds an infected file - does it have the option to CLEAN the infected file successfully?
Do you remember what version was the old COMODO Antivirus that you used in the past?
I want to try it and see if it also gives me a 'Scan Aborted' problem.

[AstroSkipper]

2 minutes ago, we3fan said:

I wanted to see if the Scan is fast or slow, and in case it finds an infected file - does it have the option to CLEAN the infected file successfully?
Do you remember what version was the old COMODO Antivirus that you used in the past?
I want to try it and see if it also gives me a 'Scan Aborted' problem.

It was a very old version long time ago. I don't remember what version number it exactly was. But what about 12.2.2 advertised by COMODO? 😜

[AstroSkipper]

12 minutes ago, we3fan said:

I wonder if the problem I have with  COMODO Internet Security Premium 12.0.0.6818  is ON MY END because I have some problem with my current XP SP3
installation or maybe I am missing something (.NET Framework, Visual C++, or a KB update).

Check all available log or dump files! Maybe, there you get a hint. 

Edited 1 hour ago by AstroSkipper

[modnar]

1 hour ago, we3fan said:

...or maybe I am missing something (.NET Framework, Visual C++, or a KB update)....

Don't you have UnofficialSP4 from harkaz installed? There is all you need in that Service Pack.