What Windows' hooks does Firefox use and how can determine if legitimate?

There is no official way to determine this, though a quick Google search by the help of a mozillian found "a quick search of the source code implies WH_GETMESSAGE, WH_CALLWNDPROC, WH_MSGFILTER and WH_MOUSE, but these could change at any time"

Not the best answer but is what exists. I hope this helps.

See also:

• http://mxr.mozilla.org/mozilla-release/source/ipc/glue/WindowsMessageLoop.cpp