When you boot into safe mode, it just loads a minimal set of generic drivers, that is it does not read the registry which is where the malware gets its instruction to load. Once loaded the spyware is sometimes tricky enough to evade the removal tools.