Two comments:

Safe mode can prevent malware from actively hiding through certain kernel mode attacks such as call interception and injection, but it *will* prevent the heuristic engine from...