Antimalware, firewall, and other security programs for Windows XP working in 2023 and hopefully beyond

[AstroSkipper]

54 minutes ago, Multibooter said:

Thanks, AstroSkipper. But pw-protected "ProxHTTPSProxy_TLS_1_3_1_5_220717_PopMenu_3V3_CheckedByAstroSkipper.7z", containing your software package, has still the same issue (false positives by Kaspersky) which I posted on 14Jan2025,

https://msfn.org/board/topic/183352-proxhttpsproxy-and-httpsproxy-in-windows-xp-for-future-use/page/61/

cacert_updater.exe and cmdow.exe inside your package still get flagged as Trojan and riskware by Kaspersky.

mediafire: "This file was uploaded from Germany on January 14, 2025 at 9:50 AM"

I surely want to believe that your package is clean. Maybe you can make these two files look clean or replace them, not just password-protect them? Many good little files have disappeared into oblivion because they were flagged.

The archive is definitely virus-free. It was password-protected by me since MediaFire uses scanner which tend to produce many false alarms. Kaspersky is as bad as the virus scanner which MediaFire is using. These files are all clean and virus-free. The cacert_Updater.exe file has been fixed by me as the original version from @heinoganda stopped working. It is totally clean. And the cmdow.exe file is a DOS file from a trusted source and checked by me. Unfortunately, some scanners don't like it but it is totally clean, too. So, forget about Kaspersky and similar scanners. Set exclusions if you trust me. And if not, don't use it.  

In any case, I will not change anything in my packages because of faulty or overly cautious virus scanners. I have invested a lot of time in programming and am not going to start compensating for the inadequacies of certain virus scanners now. 
BTW, many virus scanners don't like exe files which have been generated by BatToExe converters due to their compression type. I use such converters and don't care about false positives of those scanners. Excluding such files from scanning is my way of dealing with this nonsense. 

Edited December 27, 2025 by AstroSkipper
Update of content

[Multibooter]

1 hour ago, AstroSkipper said:

The archive is definitely virus-free. It was password-protected by me since MediaFire uses scanner which tend to produce many false alarms. Kaspersky is as bad as the virus scanner which MediaFire is using....So, forget about Kaspersky and similar scanners....
In any case, I will not change anything in my packages because of faulty or overly cautious virus scanners. I have invested a lot of time in programming and am not going to start compensating for the inadequacies of certain virus scanners now. 

https://www.virustotal.com/gui/file/767b877e735c425bf05c34683356abfde4070b092f17a4741ea5ac490611f3de
https://www.virustotal.com/gui/file/9f805311953057a944567d9a2e45ee4d65ffb7804925115b3b05bf02d3ff7821

[AstroSkipper]

5 minutes ago, Multibooter said:

https://www.virustotal.com/gui/file/767b877e735c425bf05c34683356abfde4070b092f17a4741ea5ac490611f3de
https://www.virustotal.com/gui/file/9f805311953057a944567d9a2e45ee4d65ffb7804925115b3b05bf02d3ff7821

This confirms my statement:

1 hour ago, AstroSkipper said:

BTW, many virus scanners don't like exe files which have been generated by BatToExe converters due to their compression type. I use such converters and don't care about false positives of those scanners. Excluding such files from scanning is my way of dealing with this nonsense. 

And the moral of the story: don't trust scanners blindly. 

Edited December 27, 2025 by AstroSkipper
Update of content

[Multibooter]

17 minutes ago, AstroSkipper said:

And the moral of the story: don't trust scanners blindly. 

We finally agree on something!

[AstroSkipper]

1 hour ago, Multibooter said:

We finally agree on something!

I'm not so sure about that. If you take a closer look at the scan results for the completely clean cmdow.exe file, you'll see that Kaspersky flags the file, but Panda Antivirus and Avast do not. Everyone can draw their own conclusions from this. 

Edited December 27, 2025 by AstroSkipper

[AstroSkipper]

My article about Panda Antivirus Free has been updated to include all recent information: 

 

[Multibooter]

On 12/27/2025 at 1:10 PM, AstroSkipper said:

The activation of a Panda account needs a TLS connection. That's why you have to use ProxHTTPSProxy or similar technology under Windows XP.  No chance without it since Windows XP lacks modern, secure protocols natively.

in my next attempt to activate Panda under WinXP I have used a genuine gmail email address. After entering the email address in window "Activate Panda Dome", Panda Dome again displayed "Error checking the account. We're sorry but we were unable to access your Panda account. Make sure you have an Internet connection and try again."

[AstroSkipper]

17 minutes ago, Multibooter said:

in my next attempt to activate Panda under WinXP I have used a genuine gmail email address. After entering the email address in window "Activate Panda Dome", Panda Dome again displayed "Error checking the account. We're sorry but we were unable to access your Panda account. Make sure you have an Internet connection and try again."

Without a correctly installed and running HTTPSProxy, you will get this message each time under Windows XP when trying to activate Panda. Whether the proxy is working correctly or not, you can see in its console window. If you are not familiar with these proxies, then you should read my article ProxHTTPSProxy and HTTPSProxy in Windows XP for future use.

Edited December 29, 2025 by AstroSkipper
Update of content

[Monroe]

On 12/26/2025 at 4:35 PM, AstroSkipper said:

The firewall I have been using for many years is the Sphinx Windows 10 Firewall Control Plus XP. Personally, I consider this firewall to be the best under Windows XP. And I've tried almost all of them.

OK, I did try that firewall in August or September when the Zone Alarm problems started. I had it saved from your article 'Antimalware, firewall, and other security programs for Windows XP' based on your review. I also had some other older firewall programs saved, Comodo and such. I had trouble trying to figure out Sphinx Windows 10 Firewall to get it working correctly. Probably didn't work with it enough. If I can't get the ZA working again I will install it again and check it out more. Thanks to Multibooter I want to try Kerio Personal Firewall v2.1.5 again. I had completely forgotten about Kerio FW and did not have it on my flash drive collection of firewall programs. I sort of remember it was easy to work with.

...

Edited December 30, 2025 by Monroe
sp, add

[AstroSkipper]

On 12/20/2025 at 8:03 PM, AstroSkipper said:

The second issue consists of a delay of several minutes during system start-up. Panda Antivirus needs round about 5 minutes to be completely loaded on my machine. I tried different versions and possible solutions, but nothing helped. Therefore, this issue has been reported by me to Panda's support. We will see what happens.

Forget about the Panda support! I reported the issue twice. The second report was quite detailed. No response so far. Not even an acknowledgement of receipt or the opening of a support ticket. Very disappointing!

On 12/22/2025 at 11:48 AM, AstroSkipper said:

Especially the PSANHost.exe process leads to a full utilisation of the system during computer start-up. During my tests and investigations, I have now also looked at older versions. One of these seems to run much better, with a start-up behaviour that appears almost normal. Let's see if this proves to be true over the next few days. 

On 12/24/2025 at 1:00 PM, AstroSkipper said:

I have accelerated my tests and investigations and now finally finished. And what I already mentioned in my previous post, has now actually been confirmed: an older version of Panda Antivirus Free is the solution. Panda Antivirus Free 21.01.00, the last version (from October of 2022) before the 22 series was released, runs smoothly under Windows XP without the annoying delay at system start-up. The main culprit of all versions 22.0x.0x  is the process PSANHost.exe which does not run properly, leads to a full utilisation of the system during computer start-up, a very long delay and unsightly disturbances during other operations after completion of loading. Therefore, my current recommendation is to use Panda Antivirus Free 21.01.00 on Windows XP instead of the latest version, which is currently 22.03.05. At least, until the manufacturer provides a fixed version. I have informed the Panda support in detail but don't know if they will ever react. But I do hope so. In any case, my Windows XP computer needs now again less than 2 minutes for system start-up without any unsightly disturbances during later operations. So once again, the old rule applies: the latest is not always the greatest.

Although Panda Antivirus Free 21.01.00 is running on Windows XP better than the latest version, even this version seems to have problems. And once again, the culprit is the process PSANHost.exe which yesterday suddenly started to crash from time to time for whatever reason. I'm currently trying to determine the reason for these crashes. This PSANHost.exe is slowly getting on my nerves. Either I solve the problem or Panda Antivirus will be completely removed from my system. The Panda support seems to be non-existent. 

Edited January 7 by AstroSkipper

[AstroSkipper]

On 1/8/2026 at 12:20 AM, AstroSkipper said:

Although Panda Antivirus Free 21.01.00 is running on Windows XP better than the latest version, even this version seems to have problems. And once again, the culprit is the process PSANHost.exe which yesterday suddenly started to crash from time to time for whatever reason. I'm currently trying to determine the reason for these crashes. This PSANHost.exe is slowly getting on my nerves. Either I solve the problem or Panda Antivirus will be completely removed from my system. The Panda support seems to be non-existent. 

I examined the crash dump files which were created for the PSANHost.exe process after crashing. The crashes also seem to be related to the module psanrknl.exe. And they occur precisely every 60 to 65 minutes, so to say absolutely periodically. Maybe, a time bomb inside the setup file which will be activated when the version has become too old? The Panda Antivirus 21.01.00 setup file is already more than three years old. And if this theory turns out to be true, I'll be really furious and have to reconsider my opinion of Panda. 

Edited January 9 by AstroSkipper

[AstroSkipper]

13 hours ago, AstroSkipper said:

I examined the crash dump files which were created for the PSANHost.exe process after crashing. The crashes also seem to be related to the module psanrknl.exe. And they occur precisely every 60 to 65 minutes, so to say absolutely periodically. Maybe, a time bomb inside the setup file which will be activated when the version has become too old? The Panda Antivirus 21.01.00 setup file is already more than three years old. And if this theory turns out to be true, I'll be really furious and have to reconsider my opinion of Panda. 

And in case anyone thinks I'm hallucinating, here is a proof for my observations:

Edited January 9 by AstroSkipper

[AstroSkipper]

On 5/12/2023 at 3:55 AM, AstroSkipper said:

eScanAV Anti-Virus Toolkit (MWAV)

eScanAV Anti-Virus Toolkit (MWAV) is an offline virus scanner from MicroWorld Technologies Inc., free for private and home use. And yes, it is still fully XP-compatible. MWAV provides the ability to scan for and remove any virus, spyware, adware or other malware on your computer. The database is continuously updated to detect new spyware and adware, and the scanning engine is constantly improved for faster and smarter detection.  It requires no installation and can be run directly from your computer, on whatever media. It can also run when other antivirus software is installed on your computer.
To "install" MWAV on the computer, I recommend extracting the installer manually to the desired target directory and calling the executable file mexe.com or MWAVL.exe there. Reason: If the installer is called directly, all files are extracted to the system's temporary folder. For me, this is not an option. MWAV is available in English, German, French, Nederlands, Italian, Portuguese, Spanish, Turkish, Chinese Simplified, Chinese Traditional, Greek, Korean, Norwegian, Russian, Polish and Latin Spanish.

Homepage: https://www.escanav.com/en/mwav-tools/download-free-antivirus-toolkit.asp

Version number: 22.0.60

Date of release: 26.04.2023

System requirements: Windows® 2012 R2 / 2012 / 2008 R2 / 2008 / 2003 R2 / 2003 / 10 / 8.1 / 8 / 7 / Vista / XP (32 & 64 bit OS compatible)

Minimum Hardware Requirements:

• Processor:             Intel or AMD single core x86 or x64 with SEE2 instruction set, 1 GHz recommended
• RAM:                      1 GB recommended  
• Disk Space:           1GB recommended

Review: https://www.majorgeeks.com/files/details/escanav_antivirus_toolkit.html

Download link of MWAV: https://www.escanav.com/en/antivirus-downloadlink/downloadcounter.asp?pcode=MWAV&src=english_dwn&type=alter

Download link of the (weekly) offline virus database updater: http://www.microworldsystems.com/akdlm/download/tools/esupdatebd.exe

Screenshots:





eScanAV Anti-Virus Toolkit (MWAV) is a free utility that helps Windows users to scan and remove viruses, spyware, adware and other malware that have infected their computers. It's free of charge and still compatible with Windows XP. The virus databsse can be updated online and even offline if the computer is not connected to the internet. Additionally, commercial products are offered which were tested by AV-Test and Virus Bulletin with very good results. I can definitely recommend this tool without any concerns.

Cheers, AstroSkipper

Bad news about eScanAV Anti-Virus Toolkit (MWAV)! Their free antimalware scanner can't be updated anymore. I also tried to manually do it with their (weekly) offline virus database updater but this doesn't work either. Here is a quotation from their website https://www.escanav.com/en/mwav-tools/download-free-antivirus-toolkit.asp: 

Quote

We have currently discontinued free usage of our MWAV toolkit utility.
For any enquiries, kindly write to us on sales@escanav.com.

And if you update the programme without knowing any better, it will be updated, but rendered unusable with an error message that does not tell the truth.  

Edited January 9 by AstroSkipper
Update of content

[AstroSkipper]

On 3/12/2024 at 3:49 PM, AstroSkipper said:

RogueKiller Anti-Malware

RogueKiller is an antimalware programme by Adlice Software, headquartered in France, for advanced users capable of removing stubborn malware based on a list of signatures and heuristic analysis. A command line version is also available. It is thus able to detect and remove a broad range of known and unknown malware. Its capabilities make it an outstanding tool to eliminate the most resistant infections, like rootkits. Therefore, using RogueKiller is particularly recommended for malware removal, but it can also be used to ensure the operating system's integrity. Indeed, no risk of conflict with an existing antivirus is to be expected. RogueKiller Anti-Malware comes in three versions, Free, Premium and Technician. The Premium and the Technician editions are commercial. RogueKiller Anti-Malware is fully compatible with Windows XP.

Features:

• Kills malicious programs and services.
• Drops malicious DLLs from running processes.
• Detects and kills hidden malicious programs.
• Find and remove malicious autostart entries.
• Find and remove Registry hijacks.
• Master Boot Record (MBR), Detects and remove hijacked DNS and host entries (HOSTS file).

Feature comparison Free vs. Premium vs. Technician:



Homepage: https://www.adlice.com/roguekiller/

Version number: 15.19.2

Date of release: 06.11.2024

System requirements: Windows XP / Vista / Windows 7 / Windows 8 / Windows 10 / Windows 11

Hardware requirements: A CPU with at least SSE2 instruction set.

Version history:

More can be found here: https://www.adlice.com/docs/roguekiller/release-notes/changelog/

Reviews:

https://www.thewindowsclub.com/roguekiller-anti-malware

https://www.softpedia.com/get/Security/Security-Related/RogueKiller.shtml

Download links:

Installer: https://www.adlice.com/download-start/?app=roguekiller&type=setup

Portable (32-bit): https://www.adlice.com/download-start/?app=roguekiller&type=x86

Portable (64-bit): https://www.adlice.com/download-start/?app=roguekiller&type=x64

Signatures: https://www.adlice.com/download-start/?app=roguekiller&type=signatures

Updater: https://download.adlice.com/Updater/Updater.exe

RogueKiller Command Line: https://www.adlice.com/roguekiller/cmd

Documentation: https://www.adlice.com/docs/

Instructions about updating can be found here:

https://www.adlice.com/docs/roguekiller/updating/software-update/

https://www.adlice.com/docs/roguekiller/updating/signatures-update/

Screenshots:









RogueKiller Anti-Malware is an interesting programme and mighty tool to get rid of stubborn malware. It can be used in the free version as an offline scanner and threats removal tool in addition to an already existing antimalware programme with real-time protection. If wanted, even in portable mode. Absolutely great is that it is still XP-compatible and updated on a regular base. Furthermore, the paid premium version is a real antimalware programme with real-time and ransomware protection.

Greetings from Germany, AstroSkipper

The most recent version of RogueKiller Anti-Malware is 16.5.4.0 which doesn't seem to run properly under Windows XP. Due to my tests, I can confirm that RogueKiller Anti-Malware 15.19.2.0 runs well under Windows XP. I have already updated my article accordingly. Since the 16.x.x.x versions, Windows 7 is required as a minimum according to their homepage.

Greetings from Germany, AstroSkipper

Edited January 9 by AstroSkipper
Update of content

[user57]

this one probaly will stay with us:

virustotal.com - you gonna upload your file (if the file was already uploaded the upload dont take any time)

then all anti viruses scan that file for a virus

after that you should know if it is a virus or not