Thanks for the reply. Like GetKeyState(), I think GetAsyncKeyState() just tells me about a single key. I would prefer a single function call that tells me whether any modifier has been pressed, thus saving several system calls in the hook context.

Thanks for your reply. You are right, messages really are received on title bars. I needed to test for the Non-Client messages, WM_NCRBUTTONDOWN, as well as for WM_RBUTTONDOWN. This also fixes it for the menu bars of Calculator/Paint. But the Command/MSDOS window still somehow captures messages - I see none of them, even for the title bar. How does it do this (ie. which API)? Does this mean that keyloggers also cannot intercept text typed into the Command window? This would imply that an application should grab the keyboard events directly (as in Command) to avoid snooping, eg during password entry. Regards -- Goop