Windows Neptune build 5111

Build of Windows Neptune
OS familyWindows NT
Version number5.50[a]
Build number5111
Build revision1[b]
Architecturex86 (PC/AT, PC-98)
Compiled on1999-12-10
Expiration date
Timebomb+444 days after original install date
About dialog
TCB.png TCBGallery.png BA.png

Windows Neptune build 5111 is a Milestone 2 build of Windows Neptune that is currently the only available build of Windows Neptune. It is also known as "Microsoft Neptune Developer Release" and was sent to developers on 27 December 1999. The build still includes much of Windows 2000 and Windows 2000 Professional branding, partially as the base for this build was Windows 2000 Professional build 2128, with Neptune files added on top. Although many files are version 5.50.5111.1, and this is even the true version in the kernel, the kernel actually reports 5.00.5111.1 to match the subsystem version field in its own PE header.

It includes the Activity Centers, a new login interface and user management application, as well as the new Help Center and AutoUpdate from Windows Me and several other improvements. It is also configured to hibernate rather than shut down by default.

Version number[edit | edit source]

This build has been subject to certain confusion regarding its version number. Firstly, the operating system binaries identify as build number 5111.1, however, several discs known to contain the build are labeled with the build number 5111.6. This is due to Microsoft's conflicting usage of the delta number field, which appears to have been used to mark recompiles of the same build as well as to distinguish different variants of the same compile.

Furthermore, the build identifies as version 5.00, although many files are marked with version 5.50 in their version information, and this is even the true version in the kernel. This is caused by a validation mechanism in the kernel, which compares the internal version against the Subsystem Version fields in its own executable header (offset 0x0040), and if they do not match, the kernel uses the latter.

The version number causes the Setup autorun to display a message box offering an upgrade when running on Windows XP due to its version number being smaller than Neptune's. It also offers an upgrade on this build itself due to the version number being misreported.

Known copies[edit | edit source]

There have been several different disc images available online over the years, and most have been modified in various ways, with the timebomb being completely disabled in some instances. The copy that is currently widely available was dumped from the original disc and does not include any modifications. A product key is not required for this variant, but it contains an active 444-day timebomb. Modified copies of build 5111.1 might ask for a Windows 98 product key.

The currently available copy comes from a disc burned by a Microsoft employee who worked on the Neptune project. Another disc, produced by the official burn lab, is known to exist at the Microsoft Archives and was featured in a Channel 9 video showing the archives' collection.[1]

In 2011, a person with the nickname iapx432 showed a photo of another disc in the #nttalk IRC channel.[2] The artwork printed on that disc differs greatly to both known discs, although the contents of the disc are reportedly the same as the available copy of the build. The disc label also says "Software Expires: 6/1/2001", which matches neither the timebomb itself (which is set to 444 days since the date of installation, like all later builds of Windows 2000), nor the additional date check during setup, which displays a warning but allows the installation to continue.

New features and interesting finds[edit | edit source]

Activity Centers[edit | edit source]

Although this build includes the Activity Centers, they are largely broken and incomplete. Several members of the community have attempted to fix or recreate them over the years, with varying degrees of success.

The three main Activity Centers (Photo Center, Music Center and Game Center) and the Start Page are located primarily in ACCORE.DLL, which needs to be registered to install the Activity Centers. You can do this by copying the file from the CD to C:\WINNT\System32 and running regsvr32 accore.dll. Once this is done, the Activity Center files are located in C:\WINNT\Activity. The Start Page can then be used as the Active desktop page.

The executables for the above mentioned centers are missing in this build, so the default links to them don't work. It's possible to open the individual centers with MSHTA.EXE instead.

Login screen[edit | edit source]

Although the new login screen is functionally identical to the one introduced later in Windows XP, it's actually another HTML application. It's located in LOGONHTA.DLL, with some of the functionality in SHGINA.DLL. This same login screen was later used in Whistler build 2211 and build 2223, with a new Windows logo in the latter, but then scrapped soon after in favor of a DirectUI-based one. The login screen is listed in the Add/Remove Programs control panel as "Microsoft Neptune Neptune Logon", but attempting to uninstall it fails.

The power button in the bottom left corner will initiate a hibernation by default. To restart the computer, hold down the ⇧ Shift key before clicking the button. To fully shutdown the computer, hold down the Ctrl key before clicking the button.

Windows Identities[edit | edit source]

The main page of the new Windows Identities control panel applet

This is the new user management control panel applet in NUSRMGR.CPL, also an HTML application. While the old user management control panel applet from Windows 2000 is still present initially, it will be removed by the login screen code after it's opened for the first time. This feature is also functionally very similar to its successor in Windows XP.

Neptune defines four account types:

  • Owner - This type of account is intended for people who can make system-wide changes to the computer. A person with an Owner account can make changes to all Windows accounts that have been created for this computer, such as changing account names, pictures, passwords, and account types.
  • Adult - This type of account is intended for people who can make standard changes to the computer, such as installing applications and software.
  • Child - This type of account is intended for children whose activity should be monitored and who should be safeguarded against corrupting computer settings and deleting important system files. Restricted accounts have limited access to internet content and can have limited computer time. A person with a child account can only change their own account name and picture.
  • Guest - This type of account is intended for Guests to use the computer. Guest accounts have restricted access to this computer. Settings, Themes and web browsing history will be erased each time a person with a guest account turns off the computer. Only Documents created by a guest person will be saved.

Windows XP simplified these account types into Administrators (Owner), Standard users (Adult) and a single Guest account which can be enabled.

Help and Support / PCHealth[edit | edit source]

Help and Support (previously called Help Center) has only loose ties to other Activity Centers, as it is actually stored separately from them in C:\WINNT\PCHealth\HelpCtr and is built on top of the PCHealth framework. It appears to have been directly ported from a pre-release build of Windows Me (likely build 2429) as it includes many references to the aforementioned operating system. Despite the inclusion of the new Help Center, the older HTML Help application from Windows 2000 can still be accessed from the Start menu's Help option, although a link to it has been commented out in the new Help Center homepage. An invalid link to the System Restore executable, which is not present in this build, is provided within the Help and Support Center; it is unclear if Neptune was planned to include this functionality in a later build.

Available support topics are stored in a Microsoft Access database file called HCDATA.MDB in C:\WINNT\PCHealth\HelpCtr\Database. The whole program was designed so that the database can be updated, possibly from online sources, using the HCUPDATE.EXE program and DBUPDATE.CAB MS Cabinet archive.

PCHealth is set to run at every startup to monitor the minidump directory for new minidumps after system and application crashes. If it detects such an event, it will prompt the user to submit relevant information to Microsoft for analysis via the Bug Reporting page in the Help Center.

The Bug Reporting page can be accessed either through Help Center or its dedicated desktop shortcut. It's stored in BUGREPT.CAB before it's installed. Although it originates from Windows Me build 2415, the bug reporter page was specifically adapted towards the Neptune project. The bug reporter identifies itself as version, and reports are saved to the C:\neptune_bugs directory by default. The Bug Reporting page contains two hidden sections with instructions for submitting additional files which are specifically tailored towards the DirectX and System Restore functionalities.

The Help and Support Center (and its respective bug reporting page) would be later brought over to the Whistler project from as early as build 2211, although it still saved bug reports in the same neptune_bugs directory at the time of porting.

Windows Update Auto Update[edit | edit source]

Windows Update Auto Update is another HTML application shared between Millennium and Neptune. It was meant to facilitate automatic updates via Windows Update, but doesn't seem to be fully working yet. The initial dialog will only be shown on the first run, allowing the user to read the license agreement and change AutoUpdate settings. Auto Update version in this build is, and is located in the C:\WINNT directory. The main executable is WUAUCLT.EXE, while the HTML UI components are in WUAUHTML.DLL.

Mars[edit | edit source]

An executable named MARS.EXE can be found in several early builds of Windows Me, as well as in Neptune. In early Millennium builds, the icon is a blue lower-case "m" on white background. Later on, it was changed to a yellow square smiley (";-]") with black borders. The ProductName description states "Microsoft(R) Mars (R) Communications System".

MARS.EXE interprets commands by forwarding user input to MARSCORE.DLL that loads .XML and .HTM/HTA into a windowed shell application, giving the web pages the appearance of an actual program. It seems to have been folded into the PCHealth framework during Millennium's development and was later reused by the Whistler project as part of Help and Support migration.

WIA[edit | edit source]

The new Windows Image Acquisition technology is present in this build. This includes the Still Image Service, new drivers for various scanner and camera models, and a new Control Panel folder for managing them, although the older Scanners and Cameras applet from Windows 2000 is still present as well. However, Still Image Service appears to be broken in this build, see the Known issues section for more information.

Fast boot[edit | edit source]

Neptune booting with fast boot enabled

Fast boot is a new feature presumably designed to speed up system boot time. It's contained in FASTBIKE.DLL and installed as a service. It can be enabled in the Power options, but only if Neptune is installed on a FAT partition. On the next boot, Neptune will display a bitmap saying "Optimizing boot". At some point it creates a roughly 2-2.5 MB large file named BOOTIMG.IMG in the C:\WINNT\boot folder. The image appears to contain the initial memory snapshot of boot drivers and the kernel. The specifics of how this helps speed up the boot process remain unclear.

Internal strings call this "Profile Assisted Boot Accelerator" or "PABA". DISKPERF.SYS, the Disk Performance Driver, has also been extended to support this feature. The boot screen is displayed with a lime progress bar instead of the usual blue if Neptune boots in fast boot mode. Additionally, the blue animation bar does not move.

A similar feature named Fast Startup would later appear in Windows 8.

Prefetcher[edit | edit source]

This build is the first to have the Prefetcher feature which was later introduced by Windows XP. It's meant to speed up system boot and application loading time by caching the required files. .PF files are stored in the C:\WINNT\System32\prefetch folder. Prefetcher is enabled by default, although it can be disabled by the following registry patch:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]

Application Manager[edit | edit source]

Application Manager was envisioned as a new component for centralized management of games and other applications, providing functionality such as disk quotas and file clean-up. This functionality is provided by APPMAN.DLL and APPMANDP.DLL, while the user interface was added to the Game Controllers control panel applet (JOY.CPL). However, the latter is only present in Windows Me builds 2404-2452, but not in Neptune.

This feature appears to have also facilitated Game Activity Center's game discovery feature at some point, before the Game Center was dropped. It briefly returned as part of DirectX 8.0, as it is present in the early beta build, but was subsequently removed again before the final release. Microsoft later developed similar products such as the Games for Windows Live platform and the Games Explorer feature in Windows Vista and Windows 7.

Resource Manager[edit | edit source]

This appears to be a new driver-related component, but its purpose is not yet understood. It's comprised of two files, a "WDM Resource Manager" driver RESMGR.SYS, and the "Resource Manager User Mode" RESMGRU.DLL. It was later added to Windows XP build 2202 as well, but was then removed again soon after.

Network[edit | edit source]

Net crawler was introduced in Windows Me and then ported to Neptune. It automatically searches the local network for shared folders and printers, and then creates shortcuts for them in the My Network Places folder. When shortcuts become "stale" (the device or location is no longer accessible within a reasonable time period), they are removed. This feature is enabled by default in this build, but can be disabled by checking the "Disable auto browse for shared folders and printers" checkbox in the advanced folder view options.

There is a checkbox to "Enable Firewall mode for this connection" on every network connection's Sharing options page, which suggests a firewall feature of some sort may have been planned for Neptune. It doesn't appear to be functional, though. A built-in firewall was later included with Windows XP.

Submit a comment[edit | edit source]

Also a first appearance in this build is the "Comments?" link in the title bar of most dialog windows. Clicking it brings up a feedback dialog from INSTCOLL.DLL with a brief form to explain the problem. This would then be sent anonymously, along with a screenshot of the offending window, to Microsoft.

The "Comments?" link in dialog title bars can be disabled by changing the DWORD registry value Enable in HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\Clients\Dialog Comments from 1 to 0. This feature was also added to Windows XP build 2202, but the relevant registry key has changed and also allows for changing the link text itself as well. A similar feature was added to Windows Me as well in the form of a "Survey..." button on all message boxes.

Setup[edit | edit source]

This build includes several changes related to the Windows Setup experience, most of them related to self-hosting by Microsoft employees. The setup process itself remains similar to Windows 2000, although the "Please Wait" dialog in the beginning of the GUI phase now says "Neptune installation progress", includes a progress bar and takes noticeably longer to progress to the welcome page of setup proper.

The time and date settings page includes a date check that displays a warning if the system is being installed after a currently unknown date, but allows the installation to continue.

One-touch setup[edit | edit source]

One-touch setup

One-touch setup (ONETOUCH.EXE) is used to start an automatic unattended upgrade. Upon launching, it copies UNATTEND.TXT to temporary files and displays a user account name prompt. It then attempts to modify the file with the specified name and the current computer name. Finally, it launches the regular setup executable (WINNT32.EXE) in unattended mode.

The executable was likely intended to be launched from a network share, as it fails silently when running from a CD-ROM due to Windows marking files copied from a CD-ROM as read-only. Removing the read-only attribute from UNATTEND.TXT when the initial window appears fixes the crash.

The executable has a file version of 5.00.1636.1, the same as the setup billboard library in Windows XP build 2250. It is unknown whether this is coincidental or the two features are related in some way. Timestamps in the unattend file suggest that the feature was implemented around 9 August 1999 and updated or expanded on 4 November 1999:

;/  Revision History:
;/      990809  dane    Created. 
;/      991104  nickl   Modified to facilitate an unattended clean install.

Self-hosting support[edit | edit source]

New version dialog

WINNT32A.DLL and WINNT32U.DLL setup libraries also contain two extra dialogs, one of which has a placeholder string saying "Files for Neptune build 5XXX are now available.". This dialog actually stays hidden, but is needed to run the second dialog with the postpone options, which is then displayed to the user. HIVESFT.INF also contains a commented line which would add ntcselfh.exe /noui (this program is missing from the available copy) to the list of programs to be started on system startup; the program is labeled as "Neptune Self-Host Reporting Daemon". The dialog can also be manually triggered by running winnt32 /silentcopy /unattend:C:\path\to\unattend.txt. Clicking Upgrade Now will begin the installation.

It is believed these were all part of Neptune's new self-hosting update system. NTCSelfh would probably regularly check for new builds in the background and run WINNT32.EXE with the /SILENTCOPY and /UNATTEND parameters on a network share. Setup would then copy temporary files to the machine and display the mentioned dialogs to inform the user a new update is available, with the build number obtained from the copied SETUPDD.SYS.

Out-of-the-box experience[edit | edit source]

Joindom utility

JOINDOM.EXE is set to run at first login and is used to create the first user account of the Owner type. Once the desired account name is entered, the user is asked to restart the computer. After that, the user can login into the new user account. It's described as a "pre-release Microsoft utility" in the UI, several strings inside this file suggest it's part of the out-of-the-box experience (OOBE), while the file description says "Neptune-to-Neptune Upgrade".

Neptune Credential Manager[edit | edit source]

KEYRING.EXE appears to be the precursor to the Credentials Manager from later versions of Windows, meant for managing various user credentials in one place. It's described as an "internal Microsoft tool" in the UI, while the file description says "Neptune-to-Neptune Upgrade".

Credentials can only be added using an Owner account; trying to add a credential with a non-owner account will result in an error.

.NET Framework[edit | edit source]

The file FUSEWIN.DLL references various nonexistent files, one being MSCOREE.DLL. In the context of the .NET project, Fusion was the codename for the CLR Loader, a component that loads CLR assemblies into .NET AppDomains. In the .NET Framework 1.0 Beta 1 (the earliest version available as of 2023) MSCOREE.DLL is present and is a component of the Common Language Runtime. In addition, functions within FUSELOAD.DLL reference .NET components such as ASSEMBLYINFO and assembly creation. This file, while non-functional due to missing imports, is a component of an extremely early version of the .NET Framework, several months before its PDC tech preview (from July 2000) and potentially even before the introduction of the .NET name.

Another component of the .NET framework found in Neptune is SYSXML.DLL. This is a .NET assembly using what appears to be an earlier header format and cannot be opened in .NET decompilation tools, although the Cor20 header does show in dnSpy. It is the System.Xml.dll component used in .NET apps for interfacing with XML files and refers to itself as such internally, although it refers to itself as "Microsoft(R) XML+", with the file description being "XML+ (MSXML for COM+)". COM+ is a preliminary name for the .NET Framework.[3]

My Pictures Slideshow screensaver[edit | edit source]

This new screensaver first appeared in Windows Me build 2394, and was ported to Neptune sometime after that. It plays a slideshow of the pictures in the My Pictures folder as the screensaver.

Neptune Server[edit | edit source]

This build includes the "Configure my server" wizard (SRVWIZ.DLL) from Windows 2000 Server editions, which is rather unusual for home and professional editions. An interesting fact about this particular component is that it's also an HTML application, although it predates the HTML application efforts in Millennium and Neptune.

There are also several "Neptune Server" strings inside several setup files, though this could simply be the result of a mass rebranding effort. Although multiple SKUs are defined in the anti-trust documents from 1998, it's not entirely clear whether Neptune would also include a server edition.

Driver signer[edit | edit source]

Drivers in this build are signed by "Microsoft Consumer Windows Publisher", which was also used in Windows Me, but not in Windows 2000.

Multiple desktops[edit | edit source]

The MULTIDSK.EXE program found on the disc enables the creation and use of multiple desktops. Although this was first introduced in the Resource Pack for Windows NT 4.0, the application itself is included as part of the base OS installation.

Internet Explorer[edit | edit source]

Although most of Internet Explorer in this build is version 5.0 (5.00.2919.3800 from Windows 2000 build 2128.1, to be specific), some files have been added in from a pre-release version of Internet Explorer 5.5 (version 5.50.3825.1300), among them SHDOCVW.DLL, which contains the About dialog graphic. This results in the About dialog displaying a version 5.5 graphic but saying version 5.0 just below it.

Upgrading Internet Explorer to a newer version such as version 6 is not recommended, as it tends to break the HTML applications, especially the new login screen, which renders the build unusable. Some people have supposedly managed to workaround this issue and got a working install of Neptune with Internet Explorer 6, but the details of how to achieve this are unknown.

PC-98 components[edit | edit source]

HALs for PC-98 are included; other files (AUTOCHK.EXE, AUTOFMT.EXE among others) were compiled with support for PC-98 boot sectors/MBRs. Using drivers and the bootloader from the PC-98 version of the base build (with relevant INF modifications, and patching out signature checks from SYSSETUP.DLL) is enough to get the build booting and installed on PC-98.[4]

This is therefore the latest available build (not including updates) to have PC-98 support, as the RTM build of Windows 2000 was compiled 3 days prior, and Windows XP removed PC-98 support (with partition table reading/writing being moved from the HAL to the kernel by build 2210).

Bugs and quirks[edit | edit source]

Windows Setup offering an upgrade to build 5111 from itself due to the real version number being overriden by the Subsystem Version field in the kernel's executable header.
  • The operating system identifies as version 5.0 even though the real version is in fact 5.50. This confuses cetain components such as the Setup autorun offering an upgrade from this build to itself.
  • When Fast Startup is enabled and the user attempts to boot into safe mode, the system will boot normally.
  • Hibernation is enabled by default even on non-ACPI machines. This results in the system state being saved on shutdown, followed by the kernel displaying the safe to shutdown screen.

Race condition in IDE driver[edit | edit source]

Like many late builds of Windows 2000, this build also suffers from a race condition in the IDE driver. The bug usually manifests by the computer rebooting during component installation, and Setup restarting from scratch afterwards. Often, this bug can be prevented by mashing keys and rapidly moving the mouse during the problematic phase, which slows the system down slightly, as it has to process the extra mouse and keyboard input, thus avoiding the bug. As this bug mostly appears on newer machines, it is also recommended to use 86Box or a similar emulator instead.

When using VirtualBox, the bug can also be worked around by using the VBoxManage utility in the VirtualBox installation directory to enable an artificial delay when processing IDE requests. This can be done by the following command: VBoxManage setextradata <VM name> "VBoxInternal/Devices/piix3ide/0/Config/IRQDelay" 1. After the installation completes, the delay can be disabled by setting the delay to 0.

Hardware[edit | edit source]

  • Most USB mice do not work.
  • Attempting to start an application from USB mass storage may result in a "not a valid Win32 application" error. Copying the application to the system will allow the user to run the application.
  • Some built-in display drivers may result in a "The graphics driver returned an unexpected error" when attempting to change display settings.
  • Shutting down can in some cases also result in a restart instead, most likely due to ACPI issues.

Still Image Service[edit | edit source]

The Still Image Service (imgsvc) is broken in this build and will fail to start. Because it's set to start automatically by default, it causes a delay when Windows Explorer is loading. Attempting to open the new "Scanners and Cameras" Control Panel folder will fail for the same reason, hanging the Explorer window in the process.

A little backstory to what causes imgsvc to break is whenever the service is initialized: it utilizes one of the few svchost processes, however this results into issues due to the COM and Runtime Object Table code getting in the way of the service's startup. Whilst an instance of the Image Acquisition (WIA) logger is being created, Windows checks if said svchost process is linked to the same AppID as the logger, however this isn't the case.

While the issues above can be prevented by setting the startup type to either "Manual" or "Disabled" - to prevent the service from starting automatically - there is actually a way to stop the service from malfunctioning.

To get Windows to succeed in checking if the AppID is equivalent, a registry edit can be made for Windows to succeed in checking svchost.exe's AppID. To carry out such registry edit, create a new .reg file with the following script:

Windows Registry Editor Version 5.00

If done correctly, Windows should succeed in checking whether the AppID is equivalent, and the service should load correctly.

Earlier build reference[edit | edit source]

This build includes the file TOSDVD.SYS with version number 5.50.5095.1, but it is unknown whether this file is from this build of Neptune. It's possible this could be a late Milestone 1 or an early Milestone 2 build. Judging by the PE timestamp, it would have been compiled on or before 6 November 1999.

File differences[edit | edit source]

The following files have been introduced or removed compared to build 2128.1 Professional:

Added files
Name Description Version
aec.sys Microsoft Acoustic Echo Canceller 5.50.5111.1
atrace.dll Async Trace DLL
AUHook.dll Microsoft AutoUpdate
AUSens.exe Microsoft AutoUpdate
brpinfo.dll BRPINFO Module
camocx.dll WIA Camera View DLL 5.50.5111.1
cropview.dll WIA Cropping Preview Control 5.50.5111.1
dc210usd.dll DC210USD DLL 5.50.5111.1
dc260usd.dll DC200USD DLL 5.50.5111.1
extend.dll WIA TestCam UI DLL 5.50.5111.1
fastbike.dll Fast Boot Maintenance Service 5.50.5111.1
fusewin.dll FUSEWIN 1.0 5.50.4026.2200
HCAppRes.dll PC Health Help Center Resource Only DLL
HCupdate.exe HCUpdate executable
HelpCtr.exe Microsoft Help Center
hpsclwia.dll Still Image Devices DLL 5.50.5111.1
hpsj32c.dll HPSJ32C DLL 5.50.5111.1
hpsjcoin.dll HPSJCOIN DLL 5.50.5111.1
imaging.dll Windows Imaging Library 5.00.2152.1
ircamera.dll IRCAMERA DLL 5.50.5111.1
is4xxusd.dll Still Image Devices DLL 5.50.5111.1
joindom.exe Neptune-to-Neptune Upgrade 5.50.5111.1
keyring.exe Neptune-to-Neptune Upgrade 5.50.5111.1
logonhta.dll Windows Logon UI 5.50.4026.2200
mars.exe Mars 0.00.3701.2700
marscore.dll Mars framework 1.00.3823.3000
mchgrcoi.dll Medium Changer CoInstaller 5.50.5111.1 MPEG-2 Demultiplexer.
mphpres.dll Photocenter Resource DLL 5.50.5111.1
mphputil.dll Photocenter Utility DLL 5.50.5111.1
mpmmedit.dll Photocenter DocObject 5.50.5111.1
mpwebpst.dll Photocenter DLL 5.50.5111.1
msvcp60.dll Microsoft (R) C++ Runtime Library 6.00.8168.0
msvidctl.dll MSVideo Module 1, 0, 0, 1
nusrmgr.cpl Windows User Manager 5.50.4026.2200
pccommon.dll Millennium Photocenter Common Utilities 5.50.5111.1
pchfault.exe PCHealth Fault Handler
pchprov.dll PCHealth WMI Provider
PCHSchd.exe PC Health Client Scheduling Application
pchsetup.exe Millennium Setup utility
resmgr.sys WDM Resoure Manager 5.50.5111.1
resmgru.dll Resource Manager User Mode 5.50.5111.1
rmpm.exe RM Policy Manager 5.50.5111.1
setupx.dll Windows Setup Functions 4.10.1998
shgina.dll Windows Shell User Logon 5.50.4026.2200
ssmypics.scr My Pictures Slideshow Screensaver 5.50.5111.1
stiscr.dll stiscr DLL 5.50.5111.1
testcam.dll testusd Application 1, 0, 0, 1
tvecontr.dll TveControl Module 1, 0, 0, 1
twcom.exe TWAIN wrapper 5.50.5111.1
twcomps.dll Proxy/Stub DLL for TWAIN wrapper 5.50.5111.1
UploadM.exe PC Health Upload Manager
userpp.dll Microsoft Identity Manager 5.50.3825.1300 VBI Surface Allocator Filter 5.50.5111.1
wiaacmgr.exe Windows Picture Acquisition Wizard 5.50.5111.1
wiacamd.dll WIA Camera Acquisition Dialog 5.50.5111.1
wiadefui.dll WIA Scanner Default UI 5.50.5111.1
wiadenum.dll Imaging device enumeration DLL 5.50.5111.1
wiadss.dll WIADSS DLL 5.50.5111.1
wiascand.dll WIA Scanner Acquisition Dialog 5.50.5111.1
wiascanx.dll WIA Scanner Acquisition Control 5.50.5111.1
wiaseld.dll WIA Device Selection Dialog 5.50.5111.1
wiaservc.dll Still Image Devices Monitor 5.50.5111.1 WIA Stream Snapshot Filter 1.00
wiashext.dll Imaging Devices Shell Folder UI 5.50.5111.1
wiastatd.dll WIA Status Dialog 5.50.5111.1
wiatscan.dll Still Image Devices DLL 5.50.5111.1
wiatw.dll WIA/TWAIN wrapper 5.50.5111.1
wiavidd.dll WIA Video Acquisition Dialog 5.50.5111.1
wiavusd.dll WIA Video Stream device USD 5.50.5111.1
wiaxfer.exe WIA Camera Image Downloader 5.50.5111.1
wmixmlt.dll Windows Management Instrumentation 1.50.1642.0000
wmixmlt.tlb Windows Management Instrumentation 1.50.1642.0000
wuaupd98.dll Microsoft AutoUpdate
wuv3is.dll Windows Update Engine
Removed files
Name Description Version
alrsvc.dll Alerter Service DLL 5.00.2090.1
clipsrv.exe Windows NT DDE Server 5.00.2090.1
dlc.sys NT DLC Protocol Driver 5.00.2109.1
ils.dll User Location Services Component Module 4.4.3385
ipxsap.dll SAP Agent DLL 5.00.2109.1 ActiveMovie Plug-In Distributor for IKsClock 5.00.2113.1 WDM Streaming Data Type Handler 5.00.2113.1 WDM Streaming Interface Type Handler 5.00.2113.1 ActiveMovie Plug-In Distributor for IKsQualityForwarder 5.00.2113.1 WDM Streaming VPE Property Set Interface Handler 5.00.2113.1
lhacm.acm Lernout & Hauspie Codecs 4.4.3385
mnmdd.dll Application Sharing Display Driver 4.4.3385
mnmsrvc.exe NetMeeting Remote Desktop Sharing 4.4.3385
msconf.dll Conferencing Utility Dll 4.4.3385
msg723.acm Microsoft G.723.1 CODEC for MSACM 4.4.3385
msgsvc.dll NT Messenger Service 5.00.2110.1
msh261.drv Microsoft H.261 ICM Driver 4.4.3385
msh263.drv Microsoft H.263 ICM Driver 4.4.3385
nbf.sys NetBEUI Frames Protocol Driver 5.00.2115.1
nmevtmsg.dll NetMeeting Event Logging DLL 4.4.3385
nmmkcert.dll NMMKCERT Library 4.4.3385
nwlnkipx.sys NWLINK2 IPX Protocol Driver 5.00.2121.1
nwlnknb.sys NWLINK2 IPX Netbios Protocol Driver 5.00.2090.1
nwlnkspx.sys NWLINK2 SPX Protocol Driver 5.00.2114.1
nwrdr.sys NetWare Redirector File System Driver 5.00.2117.1
regsvc.exe Remote Registry Service 5.00.2091.1
sfmatalk.sys Windows NT Appletalk protocol stack/router 5.00.2115.1
tlntadmn.exe Microsoft Telnet Server Admin 5.00.99034.1
tlntsess.exe Microsoft Telnet Server Helper 5.00.99034.1
tlntsvr.exe Microsoft Telnet Service 5.00.99201.1
tlntsvrp.dll Microsoft Telnet Server Proxy Stub 5.00.99034.1
trkwks.dll Distributed Link Tracking Client 5.00.2110.1
w32time.dll Microsoft® Win32 Time Service 5.00.2119.1
w32tm.exe Microsoft® Win32 Time Service 5.00.2119.1

Gallery[edit | edit source]

Notes[edit | edit source]

  1. As recorded in system files' version information and kernel's internal variables. Actually reports as 5.00 due to the subsystem version of ntoskrnl.exe overriding the real version.
  2. As reported by the OS.

References[edit | edit source]