Windows Error Reporting (For Hangs)


When a GUI stops responding, users will notice (among other things) three very clear signals that something is wrong:




  • Mouse clicks do nothing


  • Typing on keyboard does nothing


  • Window stops painting itself

Eventually, frustrated users will give up and attempt to close the unresponsive window.  Of course, this should have no effect since the window is not responding.  However, Windows does its best to help the frustrated user and provides a way for the user to have basic interaction with the window.  Rather, it provides a way to appear to be semi-responsive – it creates a ghost window.


Ghost Windows


When Windows detects that a window has become unresponsive, it hides the window and creates a new window in its place.  The new window is called a ghost window and has the following properties:




  • Window class of “Ghost”


  • Responsive


  • Hosted by a different process (dwm.exe)


  • Text appended to title bar: “(Not Responding)”


  • Displays a bitmap rendering of the last known good state of the hung window

Although they may look similar, the new window has none of the actual controls of the old window.


If the user interacts with the ghost window, it receives a soft tinting over its entire surface.  This is to let the user know that something is wrong with the window.  The tinting is referred to as a “frost”.  Thus, this window is sometimes referred to as a “frosted window”.


This is a sample of what the ghost window looks like with a frosted tint:


Hung mspaint.exe


To prove that it really is a ghost window, here is the report from Spy++:


Spy++ view of a hung window


In Vista and Windows 7, the ghost window only appears when all of the following conditions have been met:




  1. GUI thread has not pumped messages for over 5 seconds (default value for Vista and Windows 7)


  2. User input has been generated for the window (i.e., keystroke or mouse click)

Take note of #2 from this list.  If no user input has been generated for the window, it will not transition to a ghost window!  Since this ghost window is really just a convenience for the user, there’s no need for Windows to waste CPU time monitoring all windows in the system if there’s no user there to notice an unresponsive window.


Once the window becomes responsive again, the ghost window is destroyed and the old window is brought back into a visible state.  It is a seamless experience, and most users probably don’t realize they are actually interacting with a different window.


Windows Error Reporting (For Hangs)


Eventually, some users become frustrated enough with an unresponsive window that they will attempt to close it.  Since they are interacting with the ghost window, the close button in the corner will be responsive.  Once that choice has been made, the application will be terminated.


However, if the developer of the hung application never hears about this user’s experience, how can it ever get fixed?  That is where Windows Error Reporting (WER) kicks in.  This special mode of WER is also known as “Hang Reporting”.  Hang Reporting collects information that the developer of the application can use to determine why the hang occurred.


If application developers are responsive to these reports, their users have a chance to stay in control!


Comments (5)

  1. Kelvinzh says:

    I am a software developer in China .This article helps me a lot.

    Thank you very much

  2. Bob Bobson says:

    Nice article. I could swear there was a similar one on Raymond Chen’s blog, but I can’t seem to find it. Either way, thanks for the clear description and screenshots.

  3. David Pierson says:

    Useful to know. I had never suspected that it was a ghost (or "frosted") window. Thanks for the info.

  4. Maheshk says:

    Learned something new today !! glad to know this. Good work.

  5. Peer Larson says:

    Very nice, thank you!

    Ghost windows, huh.

    Any ideas where to find more about configuring WER (for hangs)?

Skip to main content