Need help to track what modifies a specific registry key

[Thomas R]

I had posted about this issue before in the Browsers & Mail section: “IE cannot display the webpage” after each Windows logon
Though at this point I think this is a more fundamental issue and I need help from someone with in deep knowledge of the registry.

The issue:
After each Windows logon when I try to open a webpage I get the following message: “IE cannot display the webpage”
I have to go to Tools –> Internet options and then close the window by clicking OK to set the registry value correctely to be able to open webpages with IE (Firefox is not affected)

So far I was able to identify the registry key that controls the “Automatically detect settings” check:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\
Sub Key DefaultConnectionSettings

“Automatically detect settings” check not set
0000 XX XX XX XX XX XX XX XX
0008 01 XX XX XX XX XX XX XX
0010 XX XX XX XX XX XX XX XX

“Automatically detect settings” check set
0000 XX XX XX XX XX XX XX XX
0008 09 XX XX XX XX XX XX XX
0010 XX XX XX XX XX XX XX XX

By changing that value I can check or uncheck the setting.

The issue is that after a restart (or log off/log on) the value is reset to “00” (=undefined?)
0000 XX XX XX XX XX XX XX XX
0008 00 XX XX XX XX XX XX XX
0010 XX XX XX XX XX XX XX XX

The question now is what resets this value an why.
Now I need to know how to track what accesses a given registry key. Is there any program that can do this?

 

[rap33042]

SysInternals had a utility called RegMon which monitored registry changes in real-time.
I think it has been "retired" but you can still get it on CNET here: RegMon - Free software downloads and software reviews - CNET Download.com

NOTE: I have not personally used this utility and do not know if it plays well with Windows 7.

 

[Thomas R]

Thanks for the info.
After downloading and starting it it prompted a link and the info that it was replaced by the Windows Sysinternals Process Monitor v2.94
Trying it out right now

 

[Thomas R]

I got some results but don’t really know how to interpret them. This was captured when the settings were already corrected. Lots of NAME NOT FOUND and BUFFER OVERFLOW

 

[Ztruker]

All that shows is a two queries that failed with Buffer Overflow then one that succeeded, and the value was 09 so nothing there shows it being set to 00.

I just tried it by starting it then starting IE and got the same three entries for DefaultConnectionSettings, but in my case the byte was 72, not 09. No idea what that means though. I'm running IE9.

Sure does collect a lot of data.

 

[SIW2]

You might this more useful

RegFromApp - Generate RegEdit .reg file from Registry changes made by application