It's probably using it as a quarantine, so then the virus scanner picks up virus data from it's own temp files.
Or better, does it match a sqlite signature? "The header string: "SQLite format 3\000" for example http://www.sqlite.org/fileformat.html
https://bugzilla.mozilla.org/show_bug.cgi?id=581946
It's probably using it as a quarantine, so then the virus scanner picks up virus data from it's own temp files.