Das was du suchst nennt sich Hooks.

* WH_CALLWNDPROC and WH_CALLWNDPROCRET Hooks
* WH_CBT Hook
* WH_DEBUG Hook
* WH_FOREGROUNDIDLE Hook
* WH_GETMESSAGE Hook
* WH_JOURNALPLAYBACK Hook
* WH_JOURNALRECORD Hook
* WH_KEYBOARD_LL Hook
* WH_KEYBOARD Hook
* WH_MOUSE_LL Hook
* WH_MOUSE Hook
* WH_MSGFILTER and WH_SYSMSGFILTER Hooks
* WH_SHELL Hook

HSHELL_ACCESSIBILITYSTATE
Windows 2000/XP: The accessibility state has changed.
HSHELL_ACTIVATESHELLWINDOW
The shell should activate its main window.
HSHELL_APPCOMMAND
Windows 2000/XP: The user completed an input event (for example, pressed an application command button on the mouse or an application command key on the keyboard), and the application did not handle the WM_APPCOMMAND message generated by that input.

If the Shell procedure handles the WM_COMMAND message, it should not call CallNextHookEx. See the Return Value section for more information.
HSHELL_GETMINRECT
A window is being minimized or maximized. The system needs the coordinates of the minimized rectangle for the window.
HSHELL_LANGUAGE
Keyboard language was changed or a new keyboard layout was loaded.
HSHELL_REDRAW
The title of a window in the task bar has been redrawn.
HSHELL_TASKMAN
The user has selected the task list. A shell application that provides a task list should return TRUE to prevent Microsoft Windows from starting its task list.
HSHELL_WINDOWACTIVATED
The activation has changed to a different top-level, unowned window.
HSHELL_WINDOWCREATED
A top-level, unowned window has been created. The window exists when the system calls this hook.
HSHELL_WINDOWDESTROYED
A top-level, unowned window is about to be destroyed. The window still exists when the system calls this hook.
HSHELL_WINDOWREPLACED
Windows XP: A top-level window is being replaced. The window exists when the system calls this hook.