Just spit balling here....but could we somehow go into the registry and rename Combofix so the malware couldn't recognized it and not block it?