munawar1968 wrote: _Your original poser was about about locating the correct hooking DLL. I assume you inject SAS to hide taskmanager/ capture change passwords sequence/ capture ALT-CTRL-DEL. If so, then the method you use (quite tricky to code correctly) seems ok. To capture system-wide keybd input for all threads/windows(except SAS input) one can also do without DLLs in far simpler fashion.. check this http://neworder.box.sk/newsread.php?newsid=10952_ I use it to capture CTRL+ALT+DEL. It works well. I've also done basically the same thing as you linked to. I use that to create hotkeys on my keyboard and mouse. It works really well. As for the OP, I don't know if there's a way to catch a keylogger since it's possible to completely contain it in an exe file. One thing you could try is to append a hook function on the end of the callback chain. In it you could peek at the stack and see if there are any hooks that aren't normally there in a clean windows installation. If you find one, you might be able to use the address on the stack to find out the thread that hooked the keyboard. note: the preceeding may or may not actually be possible to do. I haven't tried it and I'm no expert on hooks. :-)