I think I see why you say renaming the file wouldn’t work, but I’m a bit concerned that although Avast has successfully moved that file and changed the extension to .vir it just came back. That suggests to me something going on in the Registry.

The fact also that the infected unp files only appear when Avast is run suggest to me that something is going on with Avast itself.

OK we’ll see what happens. But I’m backing up first.