I use Avast 4.x on my Windows 2000 machine. It is lightweight and still get updates.

NT4 and above Mcafee 8.5 works and still receives updates.
Think the last version to support 9x was 4.5, and would think updates still work but not sure on that.

Only have AV on my NT4 server as that's got archive of lot of old games don't mind the performance hit over bit of extra security

With my Retro PC's (Win 3.1 - Win XP) in a Workgroup, with their IP's reserved and MAC Addresses blocked from outgoing or incoming connections, is AV that big a need for them? They are on the same subnet as my other computers that do have Internet access, but are well protected.

And all computers sit behind a firewall.

Your doing better then me!
None of my retro PC's have updates, and have internet access.
Only have my ISP's default router firewall rules and AV on my laptop, PC and Server, Laptops been infected once in the last 3-4 years but that's it. But as someone else said which I didn't think about I don't have other family members internet habits to worry about. (mrs likes her computers fruity)

malwarebytes still works on XP32_bit

there are also some linux boot cds that AV vendors make for scanning outside of the OS. Useful if you just want to make sure those old systems are clean. Only requirement is that the system be able to boot from CD (might eliminate your oldest systems).

The one I've used that seems to work pretty well is BitDefender RescueCD:
download.bitdefender.com/rescue_cd/

ESET NOD32 is a good lightweight AV that should support XP. It used to have support for 98SE. Kinda doubt it does anymore. I would guess it still supports 2000 though.