is a troubleshooting mode designed to start Windows with minimal drivers
and running processes
to diagnose problems with your computer. This means some of the programs that normally run when Windows starts will not run. Why use safe mode
? The Windows operating system protects files
when they are being accessed by an application or a program. Malware writers create programs that can insert itself and hide in these protected areas
when the files are being used. Using safe mode reduces the number of modules requesting files to only essentials which make your computer functional. This in turn reduces the number of hiding places for malware
, making it easier to find and delete the offending files when performing scans with anti-virus and anti-malware tools. In most cases, performing your scans in safe mode speeds up the scanning process. Why not use safe mode
? Some security tools like anti-rootkit scanners (ARKs) and programs with anti-rootkit technology use special drivers which are required
for the scanning and removal process. These tools are designed to work in normal mode because the drivers will not load in safe mode which lessens the scan's effectiveness. Other security tools are optimized to run from normal mode
where they are most effective. For example, Malwarebytes Anti-Malware is designed to be at full power when malware is running so safe mode is not necessary when using it. In fact, MBAM loses some effectiveness
for detection and removal when used in safe mode.
Further, scanning in safe mode prevents some types of malware from running so it may be missed during the detection process. Additionally, there are various types of malware infections which target the safeboot keyset so booting into safe mode is not always possible.Note: If the malware is not related to a running process (i.e. malicious .dll) it probably will not make a difference performing a scan in normal or safe mode. If the scanner you're using does not include definitions for the malware, then they may not detect or remove it regardless of what mode is used.
Edited by quietman7, 14 September 2010 - 12:55 PM.