BUG: Problem Setting a Systemwide WH_CALLWNDPROC Hook

• Microsoft Win32 Software Development Kit (SDK), version 4.0

SYMPTOMS

Under both Windows NT and Windows 95, a Win32 application can set a system wide WH_CALLWNDPROC hook using the SetWindowsHookEx() API. This hook allows the application to examine messages being sent by any process in the system using the SendMessage() API. The DLL containing the hook callback procedure is automatically injected into the address spaces of any process that calls SendMessage(). Under WINDOWS 95, pressing the ALT+ESC keys when the hook is installed injects the DLL into the KERNEL32.DLL process.

When the application later uninstalls the hook by calling UnHookWIndowsHookEx(), the DLL is unmapped from the address spaces of all the processes, except KERNEL32.DLL, in the system where it was injected. This leads to problems when you try to copy over or delete the DLL from the machine. These operations cause an error because the DLL file is considered to be in use by KERNEL32.DLL.

RESOLUTION

The only way to resolve this problem currently is to restart the machine.

STATUS

Microsoft has confirmed this to be a bug in the products listed at the beginning of this article. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.