For some bizarre reason, my earlier post didn't register in this thread, though it was listed in the index as having been posted at 2:08. Sigh...!
The gist of the apparently missing post is that I realize the key is a Windows key. However, it's a key used by the Windows Attachment Manager to notify registered anti-malware scanners on the system that a potentially risky file is being downloaded or received as an eMail attachment, in order for those scanners to specially scan the file. The AM's determination is based on file-types (executables) and other trust-level things. Then the AM waits for a "clear" response from the AV scanner(s) before allowing the download process to complete; if the scanner does not provide such a message, the AM blocks the download process from fully finishing at the file system level. When an anti-malware scanner automatically scans all files on a system each time they're created or used, such notification by the AM is not necessary.
What appears to have happened is that this key, which normally is defaulted to "1" (or 'off') on a Windows installation, was somehow set to something else (probably a "3") on your system, perhaps by a current or prior software installation. A key value of "1" turns the notification/blocking process off for downloads and eMail attachments on the system - no AV scanners are notified nor their responses required, and such files are not blocked by the AM. A key value of "3" turns the AM operation on for such files, and the first scanner that returns an "infected" response will immediately cause the AM to block any further operation or downloading. A key value of "2" turns the AM operation on for such files, but allows all the scanners (if multiple ones are registered) to scan before acting on any "infected" results. It may be possible that there's a latency issue involving the AM and Avira on your system that permits Avira more time to respond with its "clear" indication for downloaded files when "2" is used, compared with the more immediate reaction of the AM when "3" is used for the key - assuming some kind of time-windows are involved wherein the AM waits for a certain preset delay period before deciding the AV hasn't issued its "clear" response because it must be flagging the file as infected.
