I'm assuming that he is an adult, and there are no monitoring programs etc installed.

I know that IEAK can do this... but that is deployed on a network... not just on a single PC.

Also, when making a change in the registry, you have to be logged in as Admin. I know I can change a key in the reg on my home computer as power user and then go back into it and it won't be changed. Doh! Have to be admin...

EDIT: Doh! I didn't pick up on the fact that he is using ME... everyone is admin in ME...

If its setting it self back, there has to be something running to notice the change. Have you noticed any weird processes?

Maybe its restoring an old registry? I have seen Win98 do that automagically... I had to delete all the other reg backups to get it to stop... hmm..

Good question!