Have you thought about getting into the address space of the process that creates the window(s) and subclassing the particular window in order to capture the relevant messages?

If you don't like drivers then its possible to hook that function in a DLL and inject the DLL into Task Manager. Although I'd go with NtQuerySystemInformation then instead of Zw, since Zw are more commonly used from kernel mode and you want to intercept it in user-mode. Nt vs. Zw - Clearing Confusion On The Native API[^] --- Similiar technique in action[^]

Another way to hide entries would be to hook the ZwQuerySystemInformation API, which Task Manager calls to get a list of the running processes on the system. You can modify the linked list of processes returned by changing around the NextEntryDelta member of the SYSTEM_PROCESS_INFORMATION struct once the process is found (ProcessName member). I don't really see why you'd want to hide a process from Task Manager though -- outside of malicious purposes.

I would try creating a context menu with CreatePopupMenu() and then just delete the current selection when you click "Remove item." CreatePopupMenu http://msdn.microsoft.com/en-us/library/ms647626(VS.85).aspx[^] CB_GETCURSEL http://msdn.microsoft.com/en-us/library/bb775845(VS.85).aspx[^][^] CB_DELETESTRING http://msdn.microsoft.com/en-us/library/bb775830(VS.85).aspx[^]