The ways of AV packages are indeed mysterious.
Last week I wrote a small VB.Net program as a watchdog. All it does is listen on UDP port 32000 on IP 127.0.0.1 - and plays a DirectSound wav file if doesn't see a message in a defined time.
Norton*** Sonar keeps deleting the .exe after every few uses claiming its heuristic doesn't like it. Even after having found the Sonar exceptions setting to protect it - Sonar still deletes it on an apparently random basis.
***Yes - I know many commentards don't like Norton - but please humour my staying with a product that has previously been fine for over a decade. I've tried others and always ended up back with Norton Internet Security.