Was it really AvAgent.exe? (and not aswServ.exe?)
If so, it must've been a scheduled scan (a scan scheduled from the management server...).
Can you check, in the ADNM console, if there're any client-side sessions that may correspond to this?
Thanks
Vlk