During an antivirus scan on a running Windows operating system, some files and services used by the operating system cannot be accessed by the antivirus program. Even in safe mode, some system services are still running and cannot be scanned. Therefore, hidden malware in these services or files cannot be removed.
In such case the persistent malware can be detected and removed by Avira Rescue System. The tool is designed to scan an infected Windows system without the need to start it. With the Rescue System you can access a windows file system from a safe Linux environment.
By running this system, which is independent of the actual Windows operating system, the antivirus is able to scan the entire switched-off Windows operating system and remove hidden malware.
Further information how to create and use Avira Rescue System is explained in this article.