SF.bin freezes my computer.

[Jean Severine]

I had a similar experience, only not just with the puter freezing, but also being excluded from executing any programs on my desktop with the message i had no admin rights to execute any of the programs.  Using a system restore point cured this scary issue.

lebob's advice from the Comodo Firewall Forum on this topic works like a champ.

I use a wonderful free app called Process Explorer to monitor my puter's activities, and found, like lebob, that there was a single program triggering sf.bin in Avast, a safe program I have been using for years without a problem, that just recently began triggering sf.bin in Avast, with subsequent alerts from Comodo that Avast was attempting to run sf.bin.

My offending app was ThumbsPlus4:

"I seem to have stopped the sf.bin alerts by excluding the program triggering the alert (newsleecher in my case) from Avasts file system shield.
I went to expert settings then Exclusions and added newsleecher and set it to only exclude on Execute.
hope this helps."

[Jean Severine]

1 There is an absolutely wonderful freebee named Process Explorer which puts Windows Task Manager to shame for the comprehensive information it provides.  Download Version 14.01 of the app from:
http://technet.microsoft.com/en-us/sysinternals/bb896653

2 99% of the time sf.bin is triggered by a specific .exe app being executed.  Avast sees the app as a threat and issues an sf.bin, which Comodo and other firewalls respond to with their own warnings.  Most of the time this sequence is triggered by a completely benign and trusted .exe being executed which most likely is designed as a Packed Image.  Malware, including viruses, spyware, and adware is often stored in a Packed Image encrypted form on disk in order to attempt to hide the code it contains from antispyware and antivirus, hence the reason for the Avast sf.bin alert, EVEN THOUGH the .exe may be COMPLETELY BENIGN.

3 Process Explorer will show you the moment Avast issues the sf.bin process, it's source app trigger, and when the source app is running, whether or not it is in Packed Image format.

4 The simple trick here is to PREVENT the sf.bin from being triggered in the first place using lebob's elegant, simple solution -- After identifying the app triggering the sf.bin in Avast --

5 Open Avast's Real Time Shields > FILE SYSTEM SHIELD TAB, and click on the EXPERT SETTINGS button; select the EXCLUSIONS option; click the ADD button; browse to the target app .exe pathname; CHECK the X field to EXCLUDE SCAN ON EXECUTION; click OK and you're done.  No more sf.bin appearances.