That is your firewall or B9 (if you have it) not avast! if you click on the attachment with the .doc.safe a window should pop-up which ask permission, this should tell exactly what has changed the file extension.