i saw this once when i ran "prelink"
i know some disros do use prelink or they used to
prelink alters executables and antivir for obvious reasons doesn't like the idea of being altered
possibly prelink runs as a cron job or something ?
do you have a file /etc/prelink.conf ?
or if it is prelink doing it you can make the file if it doesn't exist and put
Code:
-b /usr/lib/AntiVir
in there to exempt AntiVir from prelinking