|
Are you sure there are no statically loaded DLLs into that process that are creating the threads either from the original process or loaded DLL? There can be lots of DLLMain codes running in that process not to mention the one WinMain. You probably have to check the DLL import list recursively from the process and for your injected DLL.
|