Hi @analogx. You are right, I were not using hooks properly, but it has been rare. Firstly, about setWindowsHookEx function, I have read WH_CALLWNDPROC or WH_SYSMSGFILTER must be used to get WM_SYSCOMMAND sent messages, and then get SC_SCREENSAVE wParam. In this case, I don't know why and maybe I'm wrong, but thats seems not to be true.
After use every possible message to SetWindowsHookEx, I realised WH_GETMESSAGE is the only one who sends SC_SCREENSAVE or SC_MONITORPOWER wParam, at least in this hook example in Windows 7.
HHOOK hook = SetWindowsHookEx(WH_GETMESSAGE,
Secondly, listening for every message caught in hook function, WM_SYSCOMMAND were appeared only if LPMSG were used. I have read also that wParam must to be combined to 0xFFF0 to be compared. But wParam & 0xFFF0 == SC_SCREENSAVE didn't work and wParam == SC_SCREEN neither. In this case the only way is using LPMSG for both.
static LRESULT CALLBACK msghook(UINT code, WPARAM wParam, LPARAM lParam)
if(code < 0)
CallNextHookEx(hook, code, wParam, lParam);
LPMSG msg = (LPMSG)lParam;
if(msg->message == WM_SYSCOMMAND)
if (msg->wParam == SC_SCREENSAVE)
if (msg->wParam == SC_MONITORPOWER)
return CallNextHookEx(hook, nCode, wParam, lParam);
And using FILE to test the events was a very bad idea, I think using MessageBox is not much better but I don't know how to test ir correctly.