From: Lowgen8 on
By coincidence, I ran rootkitreveal earlier today and saw that there were
callbacks installed for my Kerio firewall on those same 2 file functions.

(I don't run any AV.)