Mysterious app keeps you from shutting down — or does it?
At last, we have a description of the mysterious shutdown-blocking G — and a fix for Microsoft’s G-generating bug coming in the next version of Win10, commonly called 20H1.
If you look online, you’ll see hundreds (if not thousands) of reports about Win10 shutdown getting blocked by a mysterious app called, simply, G.
Most people assume it’s a virus, some other sort of malware or a harbinger of doom. In fact, it’s nothing of the sort. It’s a bug in the way Windows reports a specific kind of hang, and the bug has been fixed in the latest versions of Win10 20H1.
The KB article associated with the first Windows Insider beta build 19013 release says:
Some of you have reached out about when trying to shutdown, seeing a message saying that an app named “G” was preventing shutdown. We investigated and found an issue where windows related to GDI+were only referenced as “G.” We’ve fixed this, so going forward, these will now have the name “GDI+ Window (<exe name>)”, where <exe name> will show the .exe name of the app using GDI+.
In fact, people have been “reaching out” to Microsoft about this bug for years. I easily found six complaints on Reddit (1, 2, 3, 4, 5, 6) going back two years. General consensus on Reddit, and elsewhere, is that the afflicted machines are running malware of some sort or another. General consensus is wrong.
It’s a bug in the way the Blocked Shutdown Resolver pulls the name of the program blocking a shutdown, and “G” may result when there’s a GDI+ program (a program that draws stuff on the screen) that turns belly up as you’re shutting down.
Raymond Chen, one of my favorite Microsoft explainers, has a detailed (if weighty) discussion on the Developer Blog.
At the time the GDI+ library was written, it needed to support Windows 98, which had very limited support for Unicode. Therefore, it was compiled as ANSI and consequently used the ANSI versions of functions like
DefWindowProcto create and manage its…