Safe mode prohibits the operating system from loading device drivers, where some of those little buggers hide, so they can be seen by the AV and cleaned. No, not a necessary thing to to otherwise.
I use MSE, Avast, Malwarebytes, and will occasionally run “spybot search and destroy”. When things get real nasty, I use “Hijack This!” (NOT safe unless you know what you are doing).
These rootkit attacks will disable your antivirus software, and will interfere with a clean re-install. They randomize their filename everytime you re-boot, so it makes it hard as hell to isolate them.
The Microsoft Techs said to scrub the drive and re-install everything. Uh uh. I took it real personal and spent those hours to beat that little sh*t.
And, to all you bozo’s who write that malware code - I’m gonna get ya. In time.
Thank you for the info.......and I've got your back. LOL