Most AV programs actually do load components in Safe Mode these days. That didn't used to be true, but AV software and malware may both be running in Safe Mode. Usually they aren't fully functional, but if you were to run Combofix in safe mode with NOD32, AVG, and several other AV programs installed, you'd see a warning.

You're absolutely right about how leftovers can play Hell with system function too.