I tried some other options like editing the registry (http://answers.microsoft.com/en-us/ie/forum/ie11-iewindows8_1/lan-connection-settings-keep-changing-back-to/76a0f5d2-167f-41fa-bf40-1461b8c01642). But the moment I saved the changes, it was reverted back immediately.
So definitely there was a process doing this. But which one?
I used a tool 'UVK - Ultra Virus Killer', which is quite handy to switch between different views of services, processes, autoruns, etc.
Went into the services view, sorted the services on 'State' (just click on the header) and focused on the running ones. The names dont mean a lot and the explanations often dont give away what it is. So, google is your friend.
There was however one thing I noticed: there was a service running from my 'C\user\<login name>\appdata\local\' directory. And this was the only one, all others ran from more logical directories: Windows or Program Files main directories.
So this was the odd-one-out, also probably the reason why it could stay off the radar of the malware scanners and protectors.
The service was named 'processlocalsplGUI.exe' which would suggest it had to do something with the windows spooling processes. But then again, why such a process would run from that location was a bit of a give-away.
I tried to stop the service, but was not allowed to. Mmmmm. So I opened up the process view and there were actually two processes running from that location. I killed these processes, then disabled the service and than removed the directory they were in.
Then started IE and immediatly got the message that IE could not contact the internet since my proxy wasnt working. Yeah!!
).
I deleted the proxy settings and reverted back to check the autodectect and.... YES, finally, the changes stuck the way the're supposed to.
Then run the Autorun manager within UVK and threw out everything suspicious, which I should have done much earlier, of course, but also here: the judgment of what is right and what is bogus isn't straightforward to me. But hay, I'm not a pro, so give me some slack. BTW, this Autorun view also shows the things started by the Windows Task scheduler, which I totally forgat about: the Task Scheduler can also start processes at logon, so is always worth a look. Get rid of anything odd there too.
Now everything seem to be in order. Phew. Need some sleep now. Learned a lot past 12 hours...