I’ve once again had another situation where something has popped up in the Behaviour Shield and Avast doesn’t seem to have any issues with it.
It was something in the Windows TEMP folder and not something I had ever noticed before, which had the name cr71c32.tmp/setup.exe… I suppose I’m looking for reassurance that this is something avast! should just be leaving to lie. Is this a normal behaviour or is it just one that a new update of avast! is picking up?
The Behavior Shield is monitoring every Programs action, even from Windows,
and when they are doing something dangerous the action that they want to do will be blocked. 
cr71c32.tmp/setup.exe
is a RANDOMLY NAMED EXECUTABLE file… which is set to run from a TEMP location.
If you were intentionally installing a program — including Windows Updates (e.g. .NET updates) — they can create such a file, for temporary use, to delete after the installation is complete [sometimes after a reboot].
But if such a file appeared “spontaneously”, it’s more likely malware in action. Since this is a possibility, the Behavior Shield is justifiably suspicious of such a file.
I’m assuming you had the Behavior Shield set to ASK. As such, it’s alerting you to this “suspicious” file — which may be legitimate, or may be malware. You have to realize the circumstances of what you were doing, and act accordingly to either ALLOW it [if you were intentionally installing something] or BLOCK it [if it appeared totally on its own].
If it was suspicious of it why hasn’t it blocked it?
I have avast working at it’s default settings, I’ve never had the need to change any of them. I do not have it set to ask to my knowledge and avast never alerted me to it as being a “suspicious” file. I simply noted it on the behaviour shield and was curious as setup and .exe popping up in the behaviour shield just had me curious (and maybe concerned).
I wasn’t installing a program yesterday but it could have been updates, I’ve just never really noticed that particular activity in the behaviour shield before, for all I know it could have happened whoever knows how many times. Hard to pinpoint the when it appeared just know it was 1 of 3 yesterday before I shutdown.
If you just see it scanning the behaviour shield is doing its job.
Hi, didn’t want to clog up the site with more threads so figured I’d post in this one since it’s about the same thing I mentioned a month ago.
It’s probably happened before I noticed this today but behaviour shield again noted a c:\windows\temp\blahblee_bloo.tmp\setup.exe (sorry couldn’t remember the exact numbers and letters) and did nothing about it, I’ve not installed any programs recently, the only update that I know of happening to day was google chrome, which was the last thing to show up in the behaviour shield when I signed in not so long ago.
I’ve ran full scans in both mbam and avast! as I am now and in safe mode and it’s not found anything. Should I be concerned by this behaviour?
Also a few days ago my computer blue screened and restarted (I ran both avast and mbam scans, as well as a ccleaner clean) and have since had no other bluescreens. The report on the error noted that the issue was “WER-43742-0.sysdata.xml”.
No. (See: Reply #4) Or did you get any warning…??
No i’ve received no warning, the fact that the computer also blue screened for the first time the other day since having the computer returned a few months back. I’m just wondering if this is something avast! is letting through, just concerned that avast! isn’t protecting my computer. It has simply shown up in the behaviour shield as being scanned and not suspicious. Since I have it set to auto-decide I wasn’t sure if avast was just overlooking it.
No need to worry then.