AVG and Viper I have been told have a background process where they pre-load and run to see what is hidden within. If bad it will spit it out.
This comes from my Computer wonk bud who has had clients systems get hosed before these software packages were upgraded to stop some very nasty new threats that have surfaced within the last month or two.
Yes, adaware can do that, as can any of them actually. Turn off the real time protection and you can tell.