Basically, that is an initial keydown notification, and you send a b, and then when you callnexthook the window manager still interprets the data as an a, and then you get a keyup and you send a b anyways. You can fix this by sending the b only when it's a keydown, and not calling callnexthookex when it is a keydown you are replacing. I think.