Thanks.
Should be "NTVDM 16 bit subsystem", either keep that or protect user.exe in Components - Compatibility right side file list.
Weird that the tool picked that file to check for version, maybe they use it to detect Windows version on a weird way.