一般来说，关机或Logff后，Windows会传依序送出WM_QUERYENDSESSION的信息给每个Process，如果中间有一个Process不能顺利结束(例如：Word修改后未存档，而出现是否存档，但我们按取消)，这时该信息执行的结果会传回False(0)，这时Windows也就不再继续送WM_QUERYENDSESSION给下一个Proccess。反之，如果所有的Process都可以顺利结束(也就是每个送出的WM_QUERYENDSESSION都传回True)，那才代表以以顺利结束。

不管WM_QUERYENDSESSION最后的结果是可以顺利结束或不能顺利结束，Windows会再送一个WM_ENDSESSION的信息给所有的Process，而wParam的内容便是指出是否可以顺利结束(True菜单可以，False菜单不行，在vb中则Check wParam = 0 菜单False ， 0菜单True)，说到这里大概就知道该如何做啦，程序如下：

'以下在Form
Private Sub Form_Load()
Dim ret As Long
'记录原来的Window Procedure的位址
preWinProc = GetWindowLong(Me.hwnd, GWL_WNDPROC)
'设定form的window Procedure到wndproc
ret = SetWindowLong(Me.hwnd, GWL_WNDPROC, AddressOf wndproc)
End Sub

Private Sub Form_Unload(Cancel As Integer)
Dim ret As Long
'取消Message的截取，而使之又只送往原来的Window Procedure
ret = SetWindowLong(Me.hwnd, GWL_WNDPROC, preWinProc)
'这里只是要看看用关机的方式结束程序时，会不会执行到这里
Dim fno As Long
fno = FreeFile
Open "c:/tt2" For Append As fno
Print #fno, "ccc" + vbCrLf
Close #fno
End Sub

'以下在.Bas

Option Explicit

Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" _
(ByVal hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" _
(ByVal hwnd As Long, ByVal nIndex As Long) As Long
Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" _
(ByVal lpPrevWndFunc As Long, ByVal hwnd As Long, ByVal Msg As Long, _
ByVal wParam As Long, ByVal lParam As Long) As Long

Public Const GWL_WNDPROC = (-4)
Public Const WM_ENDSESSION = &H16
Public Const WM_QUERYENDSESSION = &H11

Public preWinProc As Long

Public Function wndproc(ByVal hwnd As Long, ByVal Msg As Long, _
ByVal wParam As Long, ByVal lParam As Long) As Long
If Msg = WM_QUERYENDSESSION Then
Debug.Print "QryEnd", wParam, lParam
Else
If Msg = WM_ENDSESSION Then
If wParam 0 Then '代表将顺利关机或LogOff，这时便得做正常结束程序的操作
Dim fno As Long
Open "c:/ttt" For Output As #1
Print #1, "hahcccc5"
Close #1
End If
End If
End If
'将之送往原来的Window Procedure
wndproc = CallWindowProc(preWinProc, hwnd, Msg, wParam, lParam)
End Function