This is proving to be more and more common as virustotal does seem to be behind in the avast VPS updates. For a live site they will be at least a little out as I believe they don’t apply vps updates in real time. So they will often be behind the users version of the vps version.

This is more likely when you have just updated the vps and find a detection, which you suspect isn’t good, but in this case you are looking at what other scanners return.