I am looking for some Win 32 code to trap Control Alt Delete. And yes, I know the implications. Thanks.
Posted on 2002-09-25 10:20:18 by skywalker
I think under windows 98 you can do it with a VXD but there's no way to do this under windows NT
Posted on 2002-09-25 10:39:17 by Hiroshimator
I know you can do it with directx using SetCooperativeLevel even under NT, and i think you can with a system wide hook under an non-NT OS (3.1,95,98).
Posted on 2002-09-25 11:36:00 by emonk
really? you can bar CTRL-ALT-DEL under NT via DX?


I always thought nothing could do that for security reasons
Posted on 2002-09-25 12:01:23 by Hiroshimator
You can do it by rewriting msgina.dll.

Exactly why do you want to do this? IMO there are only three types of people who want to do this:
- people who do not know what they are doing
- virii writers
- this is the one you fill in, it is the only genuine reason you should be trying to hook that sequence (did you think i was going to give you the answer that easily?). And if you are trying to trap for this reason, then you should use a 9x based OS, *not* NT.
Posted on 2002-09-25 20:34:04 by sluggy
I don't know how to trap Ctrl+Alt+Del.
But the only significant reason to do it , i can see, is to hide some process.
If it's implication you want, look at this:
Posted on 2002-09-26 02:39:16 by Four-F
Under 9x:
SystemParameterInfo + SPI_SETSCREENSAVEACTIVE should work.
Ctrl+Alt+Del won't respond if windows thinks that there's a screensaver running. :)

Under NT:
As sluggy said, you can replace msgina.dll, however you will need to restart before it takes effect.
You can also filter out the ctrl+alt+del key sequence by writting a global low level hook, WH_KEYBOARD_LL(IIRC). Check out the newest PSDK document for SetWindowsHookEx.

Good luck, it will be tough work... :)

Thanks for the zip, I learned a lot from it. :grin:
Anyway, I do think injecting a remote thread under NT is the easiest approach to hide a process...
Posted on 2002-09-26 04:37:05 by C.Z.
mh, a global keyboard hook *could* work...

api ref says:

To prevent Windows from passing the message to the rest of the hook chain or to the target window procedure, the return value must be a nonzero value.

so try to set up a global keyboard hook (i think it must reside in a dll) and respond with
-1 if you found that key-sequence. but i bet that the windows kernel overrides application
designed hooks... so just try it out
Posted on 2002-09-26 04:55:13 by mob
Some people have already tried that. :) They couldn't succeed with WH_KEYBOARD (for reasons I don't know), but WH_KEYBOARD_LL works very well.
Posted on 2002-09-26 05:05:56 by C.Z.
nice. never heard of WH_KEYBOARD_LL
Posted on 2002-09-26 05:43:12 by mob
Hi all,

The mdsn sample code on WH_KEYBOARD_LL, does not seem to be able to trap ctrl+alt+del but it is able to trap alt-tab and ctrl-shift-esc on my win2k.

However i do not know if it would work well on other windows os.
Posted on 2002-09-26 07:27:42 by roticv
According to MSDN WH_KEYBOARD_LL can not capture ctrl-alt-del. If you wish to permanently disable it you may cange the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout\Scancode Map" key around. But it requires a reboot.
Posted on 2002-09-26 11:12:18 by emonk
perhaps ( i haven't tried ) you could find when the user presses "crtl+alt" and then send a keyb_event of the "alt" key being released then it would seem as the user has only pressed "crl+del" ...

perhaps it would work...
Posted on 2003-04-22 05:03:50 by abc123
hmm, well even though other apps recognize the "control" button as being released upon pressing it still accepts it as pressed when i press "alt+del" .. seems odd, because "keyb_event" is supposed to create a real keyboard event but it doesn't seem to do it ( or does it but only if windows feels like letting it do so )

hmm, oh well.
Posted on 2003-04-22 06:27:26 by abc123