Virus check files uploaded by users.
In Drupal - when it can't connect you get an error on the Status Report.
The status report also shows you the version which includes the virus signature info.
As soon as it can that error goes away.
There's a "verbose" option in the config settings (which logs files that "passed" the virus check as well as failed)
You need to tick 'Enable ClamAV integration' before it will actually scan any files.
Test it's working by creating a small file with the short Eicar test signature string
Notes: ClamAV does use a fair bit of memory (because it keeps a copy of all the virus signatures)
Also sensible to run a Nagios NRPE check to ensure ClamAV is always running.
Patch:
Requires core patch to avoid possible data loss (race condition) - use my rerolled patch (#35)