I know msdn says that you can't keep track of a system wide LL keyboard hook with a debug hook, but I would try it anyway. MSDN is not always correct and they tend to copy previous versions.

Another idea is to just count the number of times User32.dll is loaded. This would require you to profile all the apps that you normally use. If you find it has been loaded one more time than needed, find out the process that loaded it and nuke it.