Boris_yo,
It could also be a startup scan.
If you client is managed, edit its Antivirus and Antispyware policy. Click Administrator-Defined Scans. Click Advanced (tab at the top). Remove the checkmark from "Run startup scans when users log on".
You may also consider removing the checkmark from "Run an Active Scan when new definitions arrive".
Does that help?
James