"Paul" wrote

| I don't know of anyplace to actually check for running hooks
|
| Would Sysinternals "handle.exe" work ?
|
I've never seen that before. But a handle is basically
just an object ID, for a window, bitmap, etc. I don't
imagine that would provide guidance about functionality.
Maybe checking out unknown DLLs in PE would work.
I don't know. I may be there's an easy way to return
system hooks, but I've never had occasion to notice.