Windows 10: Microsoft unmasks the mysterious 'G' app that stops you shutting down

Microsoft has offered up an explanation for a strange app named 'G' that for some reason has been preventing Windows 10 users from shutting down their PCs. 

The mysterious G shutdown blocker has generated concerns from Windows 10 users for well over a year now. Some were confused after seeing G error messages, but then antivirus scans didn't turn up any malware. Additionally, it didn't show a .exe name for the app.

Microsoft in October partly explained the mysterious G app in its list of bug fixes for a Windows 10 preview build from the 20H1 branch, which is due out next year.

SEE: 20 pro tips to make Windows 10 work the way you want (free PDF)    

Microsoft said it investigated user reports, found the problem and fixed the issue in 20H1. Instead of malware, it was caused by a quirk in how Windows handled GDI+, a graphics component originally written for Windows 98. GDI stands for Windows Graphics Device Interface. 

"We investigated and found an issue where windows related to GDI+ were only referenced as 'G'. We've fixed this, so going forward, these will now have the name 'GDI+ Window (<exe name>)', where <exe name> will show the .exe name of the app using GDI+," the Windows Insider team said. 

But given the number of complaints about the G app, Microsoft has decided to offer a much more detailed explanation from Raymond Chen, a Microsoft veteran who's been working on Windows for over two decades.

According to Chen, G only showed up in Windows because a bug misinterpreted Unicode text as ANSI, which usually shows up as just the first character of an app. 

"If you pass your Unicode messages to Def­Window­ProcA, then you'll find that a lot of strings get truncated at their first character, explained Chen.

The GDI+ library was written to support Windows 98, which had limited support for Unicode. During subsequent clean-ups, the GDI+ team recompiled GDI+ as a Unicode component rather than an ANSI component. 

"Except that the notification window procedure contained an explicit call to Def­Window­ProcA. Most character set mismatches would be caught by the compiler due to a type mismatch. But the character set dependency in Def­Window­Proc is not encoded in the parameter types. It's implicit in how you received the message. This mismatch went undetected by the compiler," explained Chen. 

"This mismatch also went undetected by testing because the notification window doesn't do any text processing. The title of the window got truncated from 'GDI+ Hook Window' to simply 'G', but that title isn't used for anything, so the error was of no consequence. The window title is never shown to the user. Except when it is."

SEE: Windows 10's new Cortana app: No more jokes, just email and calendar skills

So why was this preventing some Windows machines from shutting down? Chen says it's related to the Blocked Shutdown Resolver screen. 

"When a program prevents you from signing out or shutting down, Windows looks for a visible window belonging to that program and uses that to represent it in the Blocked Shutdown Resolver (BSDR) screen. But if the program has no visible windows, then the BSDR will take any window belonging to the program, visible or not. And sometimes the invisible window that gets chosen is the one named 'G'.

"That's why you end up with a message that implicates some mysterious program named 'G' as the one that is preventing you from shutting down."

More on Microsoft and Windows 10