This is exactly what I am thinking, but I've never delved deep enough into this to know much. What I do know, is that even if I apply my hook after VMWare window goes fullscreen (at least if I was VMWare, thats when I would hook the keyboard), mine still doesnt trigger. So I am thinking that it uses some sort of even lower-level hook. Like IRQ interrupts, perhaps? This is actually kinda funny. The reason I am doing the whole keyboard hooking thing is because my keyboard has those few extra keys (ie, play, stop, pause, etc), and I've had problems with the drivers for it in the past, so decided to either make my own (yeah, right. never tried, so maybe sometime in the future), or just simply hook the input, and then process the specific keys there. But since I spend quite a bit of time in a VMWare machine, the problem is very annoying.