Never mind the fact that Firefox is a browser and not a AV tool, but what exactly does it do after a download? Even on systems that have an up-to-date AV this generates a pause of several seconds after download (where I can't open the file from within the DL manager) and I have no idea what FF might be trying there.

I know I can turn it off (using FF only at work anyway) but I'm wondering. I can think of some things here what it might be:

1. FF itself is a AV scanner and it loads signatures in the background and whatnot. Sounds highly unlikely and shouldn't need tens of seconds for 20 KiB files.
2. FF tries to talk with the installed AV to munch the file. Sounds unneeded, given that most AV programs feature real-time protection anyway and therefore will have caught a virus already and also because FF does that on systems without AV installed too.
3. FF uploads the file to some online virus checker. Unlikely and stupid.
4. FF instructs some online virus checker to download the file and check it. Unlikely and would be a nice target for DoSing that service.
5. FF generates a hash of the file and sends that somewhere (presumably Google) to check for. They then respond with either "Whoa, that hash is totally a virus" or "Nope, that MD5 doesn't look very virus-y to me".

I'm running out of better ideas. Anyone have a clue?