Okay, just to close this one out.... After about 3 or 4 weeks with Sage Support looking at it, they were able to tell me only exactly what I told them to begin with. ComboFix breaks something and they don't know what. I am disappointed in the final response. They basically gave up because they could not find anyone to get in touch with at ComboFix to tell them what ComboFix changes, so could go no further. To be fair, ComboFix comes from a very black box source so not much to be done on that side. I had reached a similar end point, but mine ended with "I need to know what combofix changes" OR "I need to know how SLXSystem works".
My expectations, realistic or not, were that perhaps this could have been elevated to someone within Sage at the engineering or product development group who understands what SLXSystem needs to operate, and we could then check the handful of items required for that dll/service to run. I would think that perhaps someone at the development level would be able say, "Well it needs to have blah blah blah... Did that get wiped out?". Perhaps that did happen in the background, but I received no indication that any of that happened. Not sure what I would do without all you good folks to provide the support that I really need.
In the end, our solution was to stop using ComboFix, and to re-image all the PC's that had it applied. (Actually, once our senior IT folks found out what the helpdesk team was using, they were...... well, not impressed.... that they had not been consulted prior to its use...) Probably a good practice for infected machines anyway. Never can tell what rootkit virus and malware leave lurking even after the symptoms are gone.
Thanks to all who showed interest in this issue.
Patrick
