How can I determine the condition, which cause an execution of ON SHUTDOWN command ?
I see 3 cases :

1) User clicked an upper right cross on _screen window,
2) User tried to reload or shutdown Windows,
3) Some outer application tried to post PostMessage(hwndnext,WM_CLOSE,0,0) to my application.

In first case I need to ask user, is he really going to close the task and if so - then carefully finish all processes of application and restore initial environment. In other cases I must quickly stop an execution without any questions.
Are there any means to distinguish these 3 cases ?