I wrote a simple filter for procmail to scan mails with ClamAV.
By default clamd has a socket file under /var/run/clamav/clamd.sock and
this filter connects to it and gets the mail scanned.
It adds a X-CLAMAV header to the email to inform the reader.
Here is the script.