Comparing nt .dll loaded by two processes

[joxxx]

I am studying about a virus.The virus hooks the some functions of nt.dll loaded in to the space of explorer.exe.It seemes that the  nt.dll loaded by aother process ( say wordpad.exe) may not be hooked by the virus.Is it possible to compare the the two nt.dll address space and locate the hooked apis.I am using windows XP

 

[Scotch]

try PChunter with r3 process check feature. it will list all hooked functions in any found module and you can also export them into text file.