urlmon.dll = spyware?

Depends if your running as a user with Administrator privlages, if so than I think the installer can as theres not much blocking it. After windows might complain about system DLL's being changed, and ask you to replace them with ones from a CD.

Originally Posted by Rhodium

I don't think installers have permission to replace a system .dll like that, do they?

Because when I try to do it manually, it doesn't allow me.

WFP should also automatically replace it if it's been messed with without the proper precautions (there's a copy in the WFP dllcache directory...)