The big issue I had with ClamAV is that the entire virus definitions database has to be kept in memory which is significant on VMs with only 1 or 2GB of memory. Maybe there's away to limit the definitions to only Linux malware since IIRC the majority of the ClamAV database are for Windows viruses/malware.