The Spoony Blog

I recently ran into a very strange occurrence on my Windows box: an unkillable window. I was rebooting after installing some software that required a reboot (*sigh*) and noticed that the restart didn’t quite happen—most of my processes were killed, but there was this leftover window that wouldn’t go away. Further attempts to reboot did not result in any obvious effect, and the window refused to be closed by any normal method (though it happily moved around).

I also couldn’t start any new processes (such as a debugger); Windows wouldn’t let me because the system was shutting down. Oof. Fortunately, I did have a copy of Process Explorer already running. Process Explorer has a nifty tool where you can drag this icon (the circle-cross icon adjacent to the binoculars) onto any window, and it will tell you what process that window belongs to. I assume it uses GetWindowThreadProcessId(). However, doing this gave a curious error, something like “this window does not belong to any process”; I forget the exact wording since I didn’t write it down.

At this point, I was ready to pull the plug, but I decided to try one more thing—I started killing processes willy-nilly. When I killed services.exe, Windows got kinda upset and told me that it would be shutting down in 60 seconds because a critical process was killed, which was perfectly fine with me. But 60 seconds passed by, and Windows still did not shut down. I then killed winlogon.exe, which promptly BSOD‘ed me.

I don’t remember exactly what I did to create the unkillable window, but it went something like this: I was simultaneously debugging two copies of a particular executable, one with Visual Studio 2008 and one with WinDbg. I also at one point set the Image File Execution Options debugger key for that executable to point to vsjitdebugger.exe, and I may have deleted that registry key during my debugging sessions. The unkillable window was the console window from the debuggee of one of those debugging sessions (not sure which), and it somehow persisted after killing the debugger.

Does anyone have any ideas on what exactly can cause such an unkillable window not owned by any process to appear? And if it does appear, how can it be killed without hard rebooting? It’s too bad Raymond Chen‘s suggestion box is closed, otherwise this would be going right in there. Raymond, if you’re out there, your input would have greatly appreciated on this matter.

Filed under:
Programming by adam