Windows 7 Safemode

Question

Hello,
My question: Does the act of booting into Safemode actually fix (or change/modify) anything?
The reason I am asking: I have a Win7 machine that was displaying random "splotches" of red lines on the monitor. Restarting didn't help (the "splotches" were even on the logon screen [but only the password box]). The
owner tried many things (don't know exactly what, but he was fighting the issue for months). 
1.) My first step was to do a complete virus scan (Kaspersky). The scan did find some "AdWare" (1 file). I allowed Kaspersky to quarantine the file.
2.) I restarted the machine the splotches were still there.
3.) I ran the built-in diagnostics (HP). No issues were found (the splotches were not visible in diag nor were they visible during the POST).
4.)  I booted into Safemode to see if the splotches appeared. They did not appear. At this point I thought it must be something in Windows (video driver or..).
5.) I booted normally. The splotches were gone. ** This is the point in my question. It appears as though simply booting into Safemode "fixed" something but I am not aware that Safemode makes any permanent changes to the OS.
I have restarted several times, I let the machine run overnight, I shut it down all the way, unplugged it, let it sit for a while etc. Still the splotches are gone. I ran some software to put the video card through a "stress test". The test appeared
to go okay. Splotches are still gone. I restored the Adware file, restarted, still no splotches. Allowed Kaspersky to run again and quarantine the file. Restarted, still no splotches.
At this point the only thing I did that I cannot undo (so I can see exactly what fixed the problem) is the fact that I booted into Safemode. I have been in the IT field for 20 years. I have never seen Safemode "fix" anything. I have always
viewed Safemode as a tool to identify the issue (not fix it).
Does Safemode make any changes that would "stick"? Is there a log file somewhere that shows what it may have done? The ntbtlog.txt file just show "Loaded Driver.." and "Did not load Driver..". To be clear, the issue is
resolved I just don't know for sure what resolved it.
Thank you in advance for your time!
** Update **
I just didn't give it long enough.. The issue reappeared. Turned out to be the video card. I am still interested to know if simply booting into Safemode makes
any (permanent) changes to anything in Windows.

Answer 1

This is an interesting question. It's generally known that safe mode boots with only core drivers (found under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot), but I've never seen any explicit statement that Safe Mode does NOT make any changes. However,
I am virtually certain that Safe Mode makes no permanent changes; here's why.
The core reason is that permanent modification doesn't mesh with the core concept of Safe Mode, which is a reliable basic boot using core drivers. Adding some active process counters the whole approach of Safe Mode, which is reliability through simplicity.
It also risks destroying valuable information about the problem if arbitrary changes are made to the registry or filesystem.
Beyond this, there is a thundering absence of evidence of modification, which is a pretty reliable indicator that there is no significant persistent change made by Safe Mode. There are no special logs or log entries documenting such a change, no added service
or process that appears and would make the changes, and I've not been able to track down anyone talking about one.
A likely place to check if you want a better answer would be a forum that has kernel developers on it, possibly
https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/home?forum=wdk
This may not be a topical question there, but I'm fairly certain that someone there will either know the answer or be able to tell you where to check.