🚀 go-pugleaf

Here's some additional information that might be useful if you're 
looking at the code in the original post.

I put in some MessageBox() calls in the DllEntryPoint() function of the 
DLL -- one to report when the DLL_PROCESS_ATTACH case block executed, 
one in the DLL_PROCESS_DETACH block, and one in the if() block that 
detects when the nRefCount variable is 0 and calls DetachKeyboardHook(). 
  Each message box reports the section of the code being executed as 
well as the ID of the process attaching to/detaching from the DLL and 
the value of the shared nRefCount variable.

When several instances of the main application are started, the message 
boxes appear as would be expected with appropriate process ID and 
nRefCount values, so that part of the code seems to be working as 
expected.  The message box for detaching the hook itself only appears at 
the very end, as expected.

I mentioned in the original post that there seems to be something 
'special' about the first instance of the application to load the DLL. 
With the message boxes in place, it seems that after the first instance 
of the application attaches to the DLL, Explorer then attaches also. 
This occurs under Windows 2000 and Windows XP, so I'm assuming it's 
normal, although I don't understand why this is happening.  Subsequent 
instances of the application attach to the DLL normally, but Explorer 
does not attach again -- only attaching the first time the DLL is loaded.

When the application instances are terminated, again everything seems to 
occur as expected, but when the instance that was started first 
terminates (regardless of when it's terminated compared to the other 
instances), Explorer immediately detaches from the DLL, too.  After this 
is when the hook apparently stops working.  Maybe the association of 
Explorer with the first loading of the DLL is what is special about the 
first instance of the application, although I do not have enough 
experience with DLL's or hooks in general to even guess what might be 
going on.

Hopefully this might make sense to someone with more experience.

-- Steve