Sophos Anti-Rootkit creates a temporary executable in Local Settings\Temp?

For example Local Settings\Temp\sssahoi.exe will be created and launched but dies when you quit the sophos scanner. The next time the file name will be another random name like avassv.exe.

Is this normal? I downloaded it and it was scanned clean at http://virusscan.jotti.org/.

Anyone knows if this is normal or not?

 

Normal. Its does this so not to be noticed by malware and rootkits.

 

Some malware can block any named.exe from running by adding an entry to the imagefile execution options via the registry.

By running as a random named exe each time then the above has less or no chance to stop the exe.