The issue here is rather complex in that there is no known exploit of Windows 9x/ME in that an outsider can't gain control of said OS without you doing something to help the attacker out.
That is, you would have to install a trojan or share your file system.
Regardless, the firewall is good to find what "calls home" so you can fix or remove said software.
For now, fixes for this shutdown issue rest with you or the software that causes the issue.
You would read http://www.aumha.org/articles.htm and the Shutdown link.
They may never fix the issue since there are no new users of this old OS. It's not on the horizon that an uptick in a new user base will appear or that Microsoft will issue some "fix" for the issues that exist in this OS.
Right or wrong, you have to deal with the issues with help from others where you can find it.
--> What I would do?
Use HPGURU's HOSTS file to stop most easy/bad things from working.
Eject any pest found with Adaware, Spybot, Cwshredder and Housecall.
Best of luck,
I was having severe shutdown problems for quite a while. My machine would lockup during shutdown and I'd have to turn it off which of course led to a Scandisk of both hard drives when I would turn the machine back on again with the ubiquitous and annoying message from Microsoft to the effect that if I had shut down Windows properly, this wouldn't have happened.
During the time I was having shutdown problems, I was running two different firewalls at different times (Sygate and Zone Alarm -- both free versions). I eventually uninstalled both and as soon as I did, not only did my shutdown problems disappear, but the time it took to both boot up AND shut down decreased dramatically.
I tried contacting support for both firewalls, but received no assistance. Consequently I am currently working without a firewall. However, I have disabled all networking functions which keep all 65,536 ports closed (though not stealthed).
I'd like to once again use a firewall. Can anyone shed any light on this problem?