That would be my first thought, or an errand malware program.  However, the OP did mention that AV was turned off during an installation.  Maybe killing the process at Task Manager might do the trick.  Just because you turn it off, doesn't mean it is not silently running in the background.