Avast (and other a/v or anti-spysare programs) have explicit/implicit root kit scan capability.
Does it matter whether these are run in ‘normal’ Windows state, OR should they be run in ‘safe mode’?
Personally I don’t feel it matters, in fact I would say it is possibly better to run in normal mode.
In the case of avast as it doesn’t run in safe mode (same for most AVs as that is the point of safe mode), you would have to start avast and then run regular scans that incorporate the anti-rootkit scan.
Avast6 does a rootkit scan 8 minutes after boot as a part of the regular program, the Quick and Full System Scans do a rootkit scan (at lower levels of sensitivity) as part of the scan. So you wouldn’t normally need to specifically run a rootkit scan.
No. It not matters.
But, with avast you can, uniquely, run it at boot time for scanning. Schedule it 