 ShowGWH.exe tries to display all
a) windows hooks set by 16bit SetWindowsHook, SetWindowsHookEx,
b) global (system-wide) windows hooks set by SetWindowsHookExA,
in Windows 9x only. Use at your risk.

 Format of printed information:
idHook=WH_*  lpfn=*:*  hMod=*,*  SetBy=*
where: idHook .. one of WH_ types.
       lpfn   .. 16:16 pointer to the (16bit stub for) HookProcedure.
                 If hook is 32bit then offset can be found at the
                 beginning of 16bit stub as PUSH 32bitOffset.
       hMod   .. HMODULE,name of module containing hook procedure(s).
                 If HMODULE has >4 hexa digits it is 32bit hook.
       SetBy  .. the name of the process (usually the name of
                 main module) which called
                 SetWindowsHook(Ex(A))(idHook, lpfn, hMod, NULL).
 When hook chain contains more than one hook, younger hook is
displayed above older.

 Yes, ShowGWH is partial MSInfo32 rip because MSInfo32 is the only
existing application able to display windows hooks. ShowGWH
doesn't try to hide windows hooks set by Explorer like MSInfo32 does,
but tries to display all (32bit - global only) windows hooks.
 Then you can find that Explorer sets (16bit) windows hook of WH_SHELL
type. Hook procedure resides in SHELL.dll and is responsible for
showing application windows titles in task bar.
 If you use multiple keyboards and indicator is on (Internat.exe runs)
then you can switch between keyboards by defined hotkey (standard
Alt+LShift) and the active keyboard is showed in system tray. Again
it is WH_SHELL hook and hook procedure is in INDICDLL.dll.
 One can rule these hooks out by setting own WH_SHELL hook procedure
that will not call older hook procedures in hook chain. This is what
BlkSHELL.exe (Block WH_SHELL) does.
 Run BlkSHELL.exe in Windows 9x and start some application (calculator).
- no change in the task bar. Change keyboard - no change in indicator.
After several seconds, when BlkSHELL finishes, is all as it should be.

 For windows global hooks in Windows 9x are more suitable hook
procedures residing in 16bit (NE) modules which are still present in
the shared memory. Of course this is not the case of INDICDLL.dll
which must be present per-process (every process has own keyboard set).