sf.bin is the code emulation process used by the Avast! 5 shields to support heuristic evaluation of threats. It actually comes over as part of the Virus Database Updates. But there is no reason for OA to be watching it, so exclusion of the whole Avast5 folder is what I have done. This also helps if you have issues with avast.setup or some of the other files that avast creates and destroys as part of its update process.