There's an official shutdown message sent by Pegasus Mail:
WM_FM_LOGEVENT = (WM_FM_FORMBASE + 9);
using he following wParam value:
WLOG_SHUTDOWN = 32;[/quote]
Thanks, Michael. That will be useful. I already found a good place in which to RemoveWindowSubclass, namely, in the sub-wndproc, in response to WM_ENDSESSION (of which your explanation speaks).