Antimalware, firewall, and other security programs for Windows XP working in 2023 and hopefully beyond

[Multibooter]

I am continuing here the anti-virus discussion of AstroSkipper's flagged WinXP files uploaded to MediaFire
https://msfn.org/board/topic/183352-proxhttpsproxy-and-httpsproxy-in-windows-xp-for-future-use/page/62/#findComment-1276757 so that his topic "ProxHTTPSProxy and HTTPSProxy in Windows XP for future use" will stay focussed on ProxHTTPSProxy and HTTPSProxy.

@VistaLover I have tried to load https://opentip.kaspersky.com/ (the page to upload a file to Kaspersky for checking a potentially falsely-flagged file) with Tor Browser v7.5.6 (WinXP, 23Jun2018), but apparently this web page does not work with Tor Browser v7.5.6 under WinXP. The reason that I used Tor Browser is that I do not want Kaspersky to know my IP, for not endangering the ability to update my ancient version of Kaspersky from this IP. Unfortunately I do not have VPN.

@AstroSkipper, the co-author of cacert_Updater.exe, appears not to be inclined to clear up the false-flag reporting by Kaspersky, MediaFire and virustotal of his program. @VistaLover could you submit the falsely flagged file "cacert_Updater.exe" to Kaspersky?

@VistaLover I have been able to fetch Kaspersky definition updates after the Sep2024 US ban. The last update of my ancient version of Kaspersky was on 8Nov2024. I plan to update again in Feb.2025, or earlier if Kaspersky corrects the false flag and indicates that AstroSkipper's file will not be flagged anymore by their current signature.

BTW, I also have in my software archive the server version corresponding to my ancient version of Kaspersky (same build, same release date). Most likely the server version can still be updated, just like my workstation version. The minimum system requirements of the server version are a Pentium 400MHz, 512MB RAM and Windows 2000 Server with Advanced SP4 Rollup1. Windows Server 2003 SP2 and Windows Server 2008 are also indicated as OK. I had tried to install the server version under WinXP SP3, but I got the installer msg: "Current operating system is not supported". I did not continue any further with the server version because I don't have Windows 2000 Server installed on my computers. Nevertheless: an excellent virus checker with (most likely) a current virus signature ... for Windows 2000 !!!

Edited January 15 by Multibooter

[AstroSkipper]

@Multibooter Just a little tip. If you want to mention and reach someone from this forum, then for example @AstroSkipper is not enough, it should look like this: @AstroSkipper. Otherwise it would only be pure coincidence if your enquiry was noticed.

Edited January 15 by AstroSkipper

[FranceBB]

A while ago I wrote that Avast announced that they were gonna stop testing updates on XP despite still rolling them out. It's been a while since October 2024, but the first cracks are starting to appear. Some users have reported on the avast forum about some issues and unfortunately I was able to verify and reproduce every one of them.

We're talking about Avast 8.8.2356 build 18.8.4084.409 with the definition updates 250204-6.

Some users reported high CPU usage up to 50%. In my case, something is off as Avast is consuming 12% of the CPU resources in a 4c/4th configuration. The problem is that csrss.exe, a Windows process, started going crazy and use up between 9% and 12% CPU usage pretty much all the time which leads me to 24% total CPU usage being completely wasted. I'm sure there's something wrong that is probably looping, but I haven't yet figured out what. What's even more interesting is that even when you disable all the shields you have aswArPot.sys and aswSnx.sys being linked in the stack trace of various non avast processes even though they should be nowhere near that. Something is definitely broken. There's also another issue reported by other people at start time in which the program starts but it displays that you're not protected in the GUI until it then refreshes and everything is back to normal. Once again, that's probably one of the components failing to either start or register itself as started properly until some fallback mechanism kicks in and fixes it. The last issue reported on the forum is about the streaming updates, namely a constant connection to the avast servers that allow the antivirus to immediately get the definition updates instead of scheduling a periodic download from the server to minimise the timeframe between when definitions are released and the program is updated. Well, that unfortunately no longer works, but fortunately the scheduled downloads kick in automatically so that's not a problem. 

 

I've reported them all to the support via email, so now we're at a crucial point I think. If they do fix the issues, then it means that they're gonna keep their words and actually rely on the users for feedbacks. If they don't... well... it means that they don't care and the program will get progressively worse and more broken until the end of support in 2027...

[FranceBB]

I finally got in touch with the support, I explained them everything, I even showed them the stack trace and sent them the full memory dump along with the logs. Unfortunately, that was all time wasted as they said that version 18.8.4084.409 is from the November 15th 2018 branch and that although they’re still rolling out definition updates, they will not release any new updates to that version. From what they said, I can only assume that this means that any bug discovered will never be fixed and that essentially they don’t care about Windows XP any longer. I know that they stopped testing updates on Windows XP, but what’s the point of supporting version 18.8 and releasing definition updates if they're not checking them to make sure they’re working and even when users report the issues, they won’t do anything to fix them?! I’m so disappointed with Avast right now, which is a shame, considering that I’ve been a user since the days of version 4.8…

The last safe version for Windows XP is therefore 18.5.2342. Anything related to 18.8.4084 can be assumed to be faulty. If you're planning to keep using Avast on XP (like me), please use the offline installer to go to 18.5 and set the updates to manual so that it doesn't get updated. You can still get definitions updates, but you will have to block any program updates to avoid issues!

Edited February 9 by FranceBB

[Zorba the Geek]

On 12/17/2023 at 2:58 PM, XPerceniol said:

Please also don't forget about rogue killer that still supports XP

https://www.adlice.com/roguekiller/

i have it on my system and I has in the past found malware that I was not aware of. I don't use the "Real Time" (they offer "Real Time" )but only the portable "On Demand" free scanner because I can not afford to purchase any license right now and it just works. You have the option to select a trial for personal use that will last for 1 month but that can be reset by a simple reedit and removal of all traces, but I don't do that anymore and I allow the nag to upgrade but my machine hasn't been infected in ages now because I usually look at the same old mundane nonsense every day. Ha!

I hope that at least gives folks another option.

I strongly urge everyone not to buy Rogue Killer because it is complete rubbish.  I could see no information about system requirements on their websites so I went ahead and downloaded the latest version 16.0.1.0 but it would not install under XP.  A Google search soon located version 15.17.4 whose installation triggered DEP notices even though it has been set for essential Windows and Services.  I selected open the program after installation but nothing happened, and when I opened it from the start menu it triggered another DEP notice.  Buying a one year license and activating it went without problem.  I then made the mistake of upgrading to the latest version of Rogue Killer which has been rebranded as Adlice Protect.  This resulted in my license being deactivated, so I had uninstall the application.  I then tried to install the last version of Rogue Killer before rebranding which is version 15.19.2.0, but as soon as installation finished it started to update program components to version 16.0.1.0 and I was back to where I was before with an invalid license.  After uninstalling Adlice Protect I tried installing version 15.19.2.0 with my internet connection disabled, but I was unable to find a setting to disable program updates.  I reconnected my internet connection.but with the license correctly activated I was still in trial mode.  I uninstalled the application again and went back to version 15.17.4.0 but even with the license properly activated real-time protection and ransomware protection were disabled and there was a notice in the account section of the application saying these protections are not available in portable mode. Also I was unable to log off or shutdown Windows with Rogue Killer installed.  At this point I gave up and uninstalled Rogue Killer for the last time.

I must have wasted two hours on this rubbish, but at least it only cost me 14 euros.  A message has been sent to Adlice.

 

Edited February 9 by Zorba the Geek

[AstroSkipper]

1 hour ago, Zorba the Geek said:

After uninstalling Adlice Protect I tried installing version 15.19.2.0 with my internet connection disabled, but I was unable to find a setting to disable program updates.

I have looked at the documentation for disabling programme updates. Supposedly, there is an option with the entry:

Quote

Automatic Updates: Enables self-updates when new version is available

Did you really try this switch? 

[AstroSkipper]

8 hours ago, FranceBB said:

I finally got in touch with the support, I explained them everything, I even showed them the stack trace and sent them the full memory dump along with the logs. Unfortunately, that was all time wasted as they said that version 18.8.4084.409 is from the November 15th 2018 branch and that although they’re still rolling out definition updates, they will not release any new updates to that version. From what they said, I can only assume that this means that any bug discovered will never be fixed and that essentially they don’t care about Windows XP any longer. I know that they stopped testing updates on Windows XP, but what’s the point of supporting version 18.8 and releasing definition updates if they're not checking them to make sure they’re working and even when users report you the issues, they won’t do anything to fix them?! I’m so disappointed with Avast right now, which is a shame, considering that I’ve been a user since the days of version 4.8…

The last safe version for Windows XP is therefore 18.5.2342. Anything related to 18.8.4084 can be assumed to be faulty. If you're planning to keep using Avast on XP (like me), please use the offline installer to go to 18.5 and set the updates to manual so that it doesn't get updated. You can still get definitions updates, but you will have to block any program updates to avoid issues!

Thanks for your report! Avast 18.8.4084 was a terrible version from the start. As I reported at the time, it produced many problems. In the end, it couldn't even be uninstalled in the normal way. When I have the time and inclination, I'll try Avast 18.5.2342, although I've actually shelved Avast.

[Zorba the Geek]

On 2/9/2025 at 11:55 AM, AstroSkipper said:

I have looked at the documentation for disabling programme updates. Supposedly, there is an option with the entry:
Did you really try this switch? 

All I can see in your screenshot is a switch for automatic definitions updates, but there ought to be a switch for automatic program components updates.  I opened a ticket with Adlice and this is the latest reply I have received

Quote

We will take a look at the XP problem, but there's a big chance 15.17 isn't working on XP either; At least speaking for Real Time protection.

 

[AstroSkipper]

On 2/16/2025 at 1:44 PM, Zorba the Geek said:

All I can see in your screenshot is a switch for automatic definitions updates

Where did you see that this switch is only for automatic definitions updates? BTW, I have not only linked a screenshot, but also quoted from the online help:

Quote

Automatic Updates: Enables self-updates when new version is available

That sounds to me not only like definition updates, but also like programme updates. I cannot judge what is ultimately meant by this, as I do not have a licence. 

Edited February 17 by AstroSkipper
Update of content

[VistaLover]

53 minutes ago, AstroSkipper said:

Where did you see that this switch is only for automatic definitions updates?
...
That sounds to me not only like definition updates, but also like programme updates.

As you wrote, there's still some ambiguity surrounding the "Enable scheduled automatic updates" button your screengrab depicts; if that button controls both definitions and application "scheduled" updates, then this isn't ideal here, because v18.5 will ultimately auto-update to v18.8; if the button is set to "disabled", then definitions should be manually updated (not ideal, either); if the button behaves just like the online help quotation (and doesn't affect def updates), then all Zorba the Geek has to do is set it to "disabled" and observe how definitions are being updated (or NOT) inside the app v18.5 - if the app still auto-updates to v18.8, then he'll be sure (and us fully informed ) that the button is just for def updates...

Kind regards.

[FranceBB]

Straight from the Avast Support:

Quote

 

Avast no longer supports Windows XP as it's considered a legacy operating system. Consequently, we are unable to provide program updates for older versions of our software running on this platform, including version 18. While your Avast Premium Security installation may continue to receive virus definition updates, we are unfortunately unable to provide any program fixes or technical support for this configuration. We understand this is not ideal, and we truly regret the limitations in our ability to assist you.

Thank you for your understanding.

 

So, they're gonna keep rolling out definitions updates for 18.x so Windows XP computers are still gonna be updated, but if something breaks, they're not gonna fix it or release any new update from now on.

In theory, given that they won't be rolling out updates, they also won't break stuff (in theory), so we *should* be fine (emphasis on "should").

The only positive thing in all this is that they at least fixed the high CPU usage issue, so normal bare metal systems won't have issues:

The reason why I mentioned "bare metal" systems specifically is that there's still an issue with VBoxTray.exe when the new guest additions are installed, but that one will never be fixed. The hope is that this will be addressed by Oracle as it seems to have something to do with Avast's behavior shield which, for some reason, seems to be going berserk with the new guest additions but was totally cool with the old ones. Nonetheless, as far as Avast is concerned, the only thing we know for sure now is that:

1) They will not release any new program update (so any new bug will never be addressed/fixed)

2) They will still keep releasing definitions updates

3) They won't help anyone with XP if you try to go through their support, regardless on whether you have a paid subscription or not

 

It's not quite the end of the road, but it feels like we're slowly getting there as we're approaching 2027.  

Edited March 4 by FranceBB