Lots of you seem to think that their Anti-Virus / Internet Security suite is 'static' and behaves the same all the time .
Many of these get Daily (or more frequently) definition updates.
Those, coupled with your custom exclusions, set the behaviour
for the duration that update. An update may have been over zealous in 'fixing' a download. (Personally, I prefer the 'Ask-me what to do' setting. Firstly: you get to know something was there. Second: You get the chance to override the decision if you are sure of your source.)