Hi Martin,

Airfoil uses two hijacking techniques. The primary technique is to hijack applications at startup and inject our own DLL in after creating the process. This ensures that only the process that you wish to hijack is actually hijacked, so no rootkit or cheat detectors should pick it up.

The other technique, which is disabled by default, is Instant Hijack. Instant Hijack injects our hijacker DLL to every application using the HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs registry key. This method may be picked up by such detectors. If you find this is happening, you can easily disable it in the Airfoil preferences menu.

David