Why are you hooking in process attach, but unhooking in thread detach? So you have one hook set for when a process is attached - which could have many threads, and when any of these threads detach, the hook is removed??
Please don't delete the original post - it makes subsequent replies pretty meaningless. and is not very conducive to getting any replies to future issues!
Registered users can post here. Sign in or register to post.