Hi again. I've got a problem with Internet Security rouge program 1. It's a Russian copy of same malware that proliferates around the Enet; It ask 10 RUR in each reboot!! 2. It block any .exe files IE Taskmanager, all 3. I've used Malwarebyte and Avast: - Avast reaction - virus break Avast instantly after rebooting.!! (AV5 upd in duty) - Malwarebyte - It scan and find infected Windows.Tool.Disabled Registry value -----------------------------------its scan's log----------------------------------------- Scan type: Quick Scan Objects scanned: 103071 Time elapsed: 4 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\disableconfig (Windows.Tool.Disabled) -> (delete after rebooting). Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ------------------------------------------------------------------------------------------------------------------------------- in first path - simply removing option => after rebooting hasnt any effect second way - swith to regedit and kill disbaleSR and disablecfg => antivir said "all okay" but after rebooting virus fist again! internet availablejust in safe mode, but all Vista options and online antiviruses is not available due to browsers popblock TIA