I am checking the source code of your work and got stuck with weird thing. If I hook Draw function, it becomes restored to original function in a moment. Therefore, I need to hook it periodically in background thread which is not the good solution.
Or is there any magic I have missed?
I've seen people reporting this for Windows 8. Maybe there are ways to disable this? I don't really know...
Unfortunately, this happens on Windows 7 to. I looked into the problem more deeply and found out that DWM switches between two different Draw functions. The pointer in vtable is periodically switched to the second one periodically. Maybe it hooks this function too :)