One intersting moment when I use avast internet security and unzip special test file… Avast (with turned on File Monitor ) shows: Evo-gen [Susp]
When I turn off File Monitor for 10 minutes and save this file - then turn on and scan it via explorer context menu and also via ashcmd (with max detection rate) the same file - the file is clean, how can i received the result(Evo-gen [Susp]) in command line scanner ? The matter is i must to use avast as second av, and i only interested in its commandline functional, now use another av as main, so i must turn off all “monitors” off second av.
Some detections (or heuristics, if you wish) rely on some “context” information (what happened around the scan, what shield detected the file, where it came from, who created it, etc.).
So yes, it’s normal that some detections appear only for specific shields - there’s no way to make an on-demand scanner behave the same.