https://www.posetteforever.com/viewtopic.php?f=34&t=612&p=5963#p5963
-----------------------------------
Den Tracy
Saturday, 31 January 2004, 01:11 AM


-----------------------------------
Thanks Landman, that did the trick.

A line like "Run regedit -s sys.reg"  was writing to the registry to hijack the homepage.
It saved me a lot of time looking around.
I also found some .hta files which is another popular hijacking method.