I read in a previous thread (http://forums.majorgeeks.com/showthread.php?p=1118784) a recommendation to kill combofix after 2 hours of activity without resolution. I want to report here my experience which was completely different. Yesterday, combofix was running for about 3-4 hours while the dos screen was showing the following message: "Scanning for infected files... This typically doesn't take more than 10 minutes However, scan time for badly infected machines may easily double" Since there was no error message and I could visualize continued hard drive activity, I have decided to go to sleep and see what will happen in the morning. When I got back to my laptop about 6 hours later there were a couple of window messages on the screen (I did not pay attention to them -> just clicked OK and they disappeared) and then Combofix screen changed to the following message: "You are infected with the Rootkit.ZeroAccess! that has inserted itself into your TCP/IP stack. This is a particularly difficult infection....etc." (Mind you, this was after I have previously "successfully" treated this infection with TDSSKILLER, tough with some neccesary modifications). Shortly after Combofix rebooted and when it came back up it had started to go through the "completed stage_1 to 50" within about 10 minutes after the reboot, and completed its job. From what I (non professional) can decipher from the Combofix report, Combofix was able to delete the files associated with this Trojan. The moral of the story: If the hard drive shows activity - do not kill Combofix even if it takes it many hours to start going through the various stages.