well there is a little trick we an use then to investigate more. avast creates a unp123456789tmp file that is only available when sett to ask, this can be uploaded to VT to see if only avast or others also detect