Yes, I also have 2 directory's in my /tmp dir. (using ISPconfig 2.2.10 and the clamasassin fix)
One of the dir's does have some stuff in it!
host:/tmp# cd clamav-24465acfba690eb49a98090fe5bd3f70
COPYING main.db main.hdb main.ndb
I have no clue what's causing this..!