Search code examples
windowsshutdown

How is shutdown.exe unclosable (under Windows XP)?


How does the Windows program shutdown.exe make itself unclosable, even from Task Manager, but how does shutdown /a terminate it? From the disassembly, it looks like it may be built into the kernel, but I'm unsure. I am not going to use it to write malware.


Solution

  • The program shutdown.exe does not make itself uncloseable, in fact it normally exits immediately. The window you're talking about is generated by the operating system itself to warn the user that a system shutdown is pending. (In more recent versions of Windows this warning is presented differently.) You can get the same effect in your own code by calling InitiateSystemShutdown.

    Similarly, shutdown /a doesn't terminate the window, it just calls AbortSystemShutdown to cancel the shutdown. Windows then removes the warning window since it is no longer applicable.

    If you were to figure out which process is actually generating the window, you could no doubt terminate that process, assuming you have admin access. On the other hand if it is one of the system critical processes then terminating it will crash the system.