urlmon.dll = spyware?
 

A program installed urlmon.dll, is it spyware?

The thing is, I think that urlmon.dll comes with windows anyway, so why would a program be installing it again?

Hey. What the heck is wrong with YOUR search engine? Why not do a little checking before asking such questions. The net if full of information about "urlmon.dll." Including such listings as the following:

http://www.liutilities.com/products/wintaskspro/dlllibrary/urlmon/

but it is just one of many, many.

Regards,

Ok, but why would the program be installing the .dll then?

Maybe I should replace it with the original one again.

Or maybe the OS was replacing it. If your sure it was another program you probably already know how to search for spyware, and if not there is a Thread a few spaces below this one with the names of several. ;)

Regards,

Interesting.

The urlmon.dll available here: http://www.dll-files.com/dllindex/dll-files.shtml?urlmon

Is a different size than the one in my system32 folder, and on this page it says to extract the dll to windows/system and not system32:

I don't think installers have permission to replace a system .dll like that, do they?

Because when I try to do it manually, it doesn't allow me.

Might depend on which OS you are running. I'm running WinXP Pro SP1. On my machine there are two copies of the file. One in Windows\system32 and another in windows\servicepack files\.

The one in system32 is 473 KB 1/21/2004, while the one in servicepack is only 445 KB 08/29/02. Just by chance do you have automatic update turned on by default? It could have been a download from M$.

Regards,

Maybe it was just registering the .Dll to load at startup.

It was a startup/reg monitor that detected it.

Depends if your running as a user with Administrator privlages, if so than I think the installer can as theres not much blocking it. After windows might complain about system DLL's being changed, and ask you to replace them with ones from a CD.

WFP should also automatically replace it if it's been messed with without the proper precautions (there's a copy in the WFP dllcache directory...)