have you checked the logs in the AV program. it normally shows all activity in the log.
And yes, highly likely this was an AV program