1. only user slangmgh posts the legit slang extension files in ecco_pro forum.    In the eccomagic, official, 100% virus free, 100% spyware free files are posted in eccotools forum.  These are certified virus free.  Note: files in user files forum are tested for virus,  but not 'certified' virus free.    
 
2. Avira and some other virus scanners have some known issues.  At least one EM tool is detected by some as Virus (multi-monitor fix).  It is not.  It uses virus like code to attach to ecco's dialogs,  and thus looks to a few scanners as possible virus.  
 
3. True to current version ( 4.5.2 series ), the core of the slang extension does not test true for Avira virus.   Only the 'injector' (which is in a sense a virus,  but a helpful one... injecting into ecco program).
 
4. Much (in size) of code comes from other sources,  such as LUA programming engine,  or regex engine.   Thus even if all ecco side are safe, a virus from the other sources is always a possibility.
 
5. suggest: use version that Avira says is clean.  When major new feature/bug fix comes (you can check the eccoext.eco file for latest changes  ) then re-request from Avira for adding to exceptions list.    
 
 
6. "Slang" has been working for YEARS on the machine level code of eccoPro.   Slang has invested a HUGE amount of effort.  and is the leading (by far) expert on this planet regarding the machine code in ecco.  No one else comes close,  or even close to close.