The root kit that has been doing the rounds recently infects service and system drivers. ComboFix will delete those without giving a second thought. The infected files are somewhat arbitrary but usually involve parts of the network stack.

Missing low level hidden services usually end up in the visible services failing to start and from there, Windows will do funny things. Take a look in the services admin console for any "automatic" services that are not running.

See if those left traces in the event log reading like "service scheduled for deletion". If so, find out what is supposed to be there for the version of Windows involved and make sure all files and registry entries are present and correct. (These are not just the services you can see via the admin console, it involves the entire list in the registry at HKML/System/CurrentControlSet/Services). If anything is missing, copy the files and export/import the registry entries from a clean box running the same version of Winders.