In my early experiments with running various DOS & Win 32 bit programs under Linux I tried, and indeed did use for a while, Oracle's Virtual Box. The main problem I found was that it was a multi-load sequence to run the DOS program – load Linux, load VB, load XP, load DOS program, whilst shutting down was only slightly less time consuming. Other than that, everything worked ok with lots of access to my data files. One way of speeding up somewhat was to write a DOS batch file for use within XP and thus automate some of the sequences. The major problem, though, was that the system just wasn't fast enough with the DOS program stuttering when trying to rapidly step through data records. Eventually I had to abandon VB in favour of DOSEmu.
In respect of anti-virus & other support for deceased Windows versions, I used to run, eg SuperAntiSpy on Windows 2000. When W2K was eventually abandoned by Microsoft, initially SAS et al all worked satisfactorily, however, as time rolled by, scan times became slower and slower, with SAS in particular taking many hours. The effective result being that I was forced to upgrade regardless of my wishes if I wished to maintain system protection. Thus, when support for XP was ceased, in addition to the other problems of hardware & software compatibility, I could envisage a loss of system protection as well.
Peter G. Shaw