Just curious

[Still learning]

Why is it better to scan for malware/spyware in safe mode as opposed to
normal windows? I have noticed that people *do* make that distinction, and
I've often wondered why.

 

[R. McCarty]

Safe mode is a "Basic/Core" Windows XP session. Safe mode omits
3rd-party drivers and services from starting. By running scans in Safe
Mode it means that Viruses/Trojans & Malware may be present on
the machine but the minimal run mode prevents them from starting and
being in active memory.
It functions sort of like curing a disease without the symptoms of the
diseases being present.

 

[db.·.. >]

for simplicity:
safemode is "pure"
microsoft windows.

that is to say that only
first party software and
drivers are loaded and
these are all from / by
"microsoft".

in normal mode first
and second party drivers
and software are loaded
in addition to some first party
drivers from microsoft.

that is to say that windows
will load up and also load any
other programs that you
have installed for your
enhanced experience with
windows.

depending on the third party
software, they can substitute
first party drivers with their
own.

and if the third party software is
malware then it will substitute
many files that are "genuine"
microsoft windows with their
corrupted versions.

therefore, running third
party software like antivirals
via safemode is not likely
possible.

 

[John]

A lot of today's Viruses/Trojans/malware run in safe mode making it more
difficult to get rid of.

 

[Phisherman]

Why is it better to scan for malware/spyware in safe mode as opposed to
normal windows? I have noticed that people *do* make that distinction, and
I've often wondered why.

In Safe Mode your computer is less likely to have conflicts with
resident software, will have more resources available, and Malware is
less likely to hide in memory in Safe Mode.