avast detect the installation of the keylogger (spyware) and warn you about that.
How is set your ‘archive files’ scanning?
Did you scan the file after the download (with ashQuick.exe)?
Heuristics are for email (attach) but not for ‘scanning’ itself, I mean, the attached file could be not scanned at that time depending on your configuration… :-\