A normal application program cannot intercept the <CTRL>-<ALT>-<DEL> key sequence (which is called a "Secure Attention Sequence", or "SAS") in a Windows NT-family operating system (Windows NT, 2000, XP, 2003, Vista, 2008, and 7). Only a program with "Administrator" level access to the system (actually, "SYSTEM" level access, but I'm simplifying) can do this.
Imagine a scenario as follows:
An evil user, Mallet, writes a program that mimics the Windows logon interface. Mallet logs on, runs his program to mimic the Windows logon interface, and walks away.
When someone tries to "logon" using this mimic interface, though, an obscure sounding error message is displayed. As the error is displayed, the username and password entered by the user (which probably were valid) is emailed to Mallet.
The annoyed user who was attempting to logon dismisses the error message. The mimic program issues a "Log Off" call to the operating system such that the user is then presented with the real Windows logon interface. The user logs-on successfully, figures that they just "fat fingered" their password, and goes about their work.
Mallet logs-on to every computer in every computer lab in his building and runs his mimic program and receives a large number of likely-to-be valid usernames and passwords in his email.
The reason for the "SAS" functionality in the operating system is to prevent this kind of malicious activity. When enter the "SAS" sequence (which in Windows NT is <CTRL>-<ALT>-<DEL>, but could just as easily be a dedicated hardware button, smart card reader, etc) you are guaranteed to receive a user interface from the operating system itself, and not a malicious third-party program. This "guarantee" assumes that no Administrator-level user or malicious attacker with physical access to the computer (who could then disassemble the computer and insert malicious code) has "corrupted" the operating system. If malicious users have "Administrator" level access or can disassemble the computer or otherwise inject code into the operating system (through, say, a bug in the operating system) then all bets are off.
The SAS functionality is a piece of an overall security strategy. By itself it's fairly weak, but as part of a layered security model it does stop some specific types of attacks.
As an aside: The sequence <CTRL>-<ALT>-<DEL> was chosen because Windows NT (where it was originally introduced as an SAS) was to be compatible with both MS-DOS and 16-bit Windows applications. This key sequence was a good pick because in MS-DOS and 16-bit Windows the <CTRL>-<ALT>-<DEL> sequence would initiate a reboot and, as such, taking over that key sequence for an operating system function wouldn't "deprive" users of a key sequence in application software.