Trapping CTRL-ALT-DEL in Win95

I would like to know what method would reliably trap a CTRL-ALT-DEL request by the user before Windows 95 picks it up.  (And displays the "Close Program" dialog box) Would it be through a virtual key handler or revectoring the interrupt?  We don't want to suck up more than 0.5% system resources doing it either.  Obviously, code samples would be helpful.
Who is Participating?
There is no way to trap it, only to disable it. If you want me to post here code to disable it, leave a comment
As MikeP told, here is code to disable CTRL_ALT_DEL

' *** Disabling Ctrl-Alt-Delete and Ctrl-Esc
Private Declare Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As Long, ByVal uParam As Long, ByVal lpvParam As Any, ByVal fuWinIni As Long) As Long

Sub DisableCtrlAltDelete(bDisabled As Boolean)
   ' *** Sub DisableCtrlAltDelete(bDisabled As Boolean)
   ' *** To disable Ctrl-Alt-Delete:
   ' *** Call DisableCtrlAltDelete(True)
   ' *** To enable Ctrl-Alt-Delete:
   ' *** Call DisableCtrlAltDelete(False)

   Dim X          As Long
   X = SystemParametersInfo(97, bDisabled, CStr(1), 0)

End Sub

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

If you want to trap, use a Keyboard hook.
I'm pretty sure you can't trap it with a keyboard hook.  The hook isn't notified.  The first parameter to the SystemParametesInfo (97) is the constant SPI_SCREENSAVERRUNNING.  Microsoft recomends that you do not use this feature.  So you do so at your own risk.  
Better to 'do it on you own risk' then not doing at all, if he relly needs it. becedes, it worked on 3.1, 95, 98, and I think on NT as well. What are the chances it is going to change?
The docs say it doesn't work on NT.  But that was probably for versions before 4.0.  I suspect it will not work some day, however.  Its good to know it works on 98.  That has been questioned.
i recently figured out how to disable cAD on NT... It works like a charm....
Not going to share it with the rest of the class?
He is going to sell it for points :)
Sorry, Not this time around.  
mikep: perhaps :)  .  But I am sure when MS finds out how I did it they will patch their code... so even if I tell, it will probably be fixed fairly quickly.  thats been my experience in the past...
I agree with MikeP that it still works under '98.  Too bad nothing else does (at least from my experience)!

wsaitoh - If you want to prevent your program from showing up in that little box, use this:

  #define REGISTER 0
  #define UNREGISTER 1

  typedef DWORD (WINAPI *fp_RegServProc) (DWORD, DWORD);
  fp_RegServProc pRegisterServiceProcess = NULL;

  pRegisterServiceProcess = (fp_RegServProc) GetProcAddress (GetModuleHandle ("KERNEL32.dll"), "RegisterServiceProcess");

  pRegisterServiceProcess (0, UNREGISTER);
wsaitohAuthor Commented:
I appologize for not clearly asking the question originally, but I will see how the above will work to trap CTRL-ALT-DEL.  What would it take to get a message to your app. that the above was trapped, let the app. bring up its own dialog on certain conditions and during all other times, let it pass through to the system as normal?  Thanks.
c2cap95 example is a static VxD that loads before Windows starts and you can't unload. It install itself hooking keyboard at DEVICE_INIT message.
I think that you need to convert it to a Dynamic VxD and provide a DEVICE_IO_CONTROL interface to "talk" to a Win32 App.
In such a way, you can send messages from a Win32 App to the VxD to enable, disable or whatever you want to do in the VxD.
Let me know if you need more help on writing this kind of modules.


Did you ever figure out how to do what you wanted?  If I understand you correctly, I want to do the same thing.  I want to add to the existing Ctrl-Alt-Del functionality.  Whether I do this by adding another button to the dialog or by showing my own dialog before showing the standard one, or by some other way, I don't much care.  However, if I can preserve the existing functionality without having to rewrite it, that would be best.

I looked at Ctrl2cap (mentioned above) but it seems only to give me the interception functionality.  I'm still clueless as to how to alter the existing dialog (as in the first option) or how to bring up the standard dialog after I intercept (as in the second option).

Thanks for any insight,
Hi Jorge,

An alternate thing the person can do (this one only works on 9x) is thunk to 16 bits with a call to the EnableHardwareInput API.  MS says this function is obsolete, but I tell you it's not.

It's in the system dll's and u can get to it via a true thunk ( )
or just make a simple call to QT_THUNK.

QT_THUNK is exported by Kernel32.dll on 9x

QT_THUNK is undocumented, but before you say u don't want to use it, note that Microsoft uses it to perform their transforms internally from the flat world to the segment world (32 to 16 bit).

if anyone is interested in this undocumented function, they need to get their hands on Matt Pietrek's book: "windows 95 system programming secrets" You can see it here:

Another good author with much information to share is Jeffrey Richter:

Now if you thunk down to 16 bits and call EnableHardwareInput at different times during your program, you can effectively disable control+alt+delete because all keyboard/mouse input will be disabled across your whole system. (very anti win32).

Also note the above only works on win9x.

Good Luck.  But yeah Jorge, thats some out of the box thinking.  Thats one of the things people need to do to make windows work for them.


David, you're right!
But, in my opinion, Win95 is an obsolete OS. Today I think the better way to do this kind of software, is to go into WDM.
WDM runs only on Win98 and NT.
On there's a lot of info about writing WDM's.
I'm trying to forget to write VxD's and migrate to WDM.
If someone like to have a look at a WDM to intercept keys, visit the Walter Oney's page or let me know, to post some sample code.

One more thing about Craig's comment: Ctrl2Cap just intercept keyboard, right!
But this module uses a VxD function that you can use to intercept, to passtrough, to change (add or remove) keys or whatever you want.
You have full control over the keyboard.
In the past I posted a piece of code on .

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.