You could use strace to attach to the clamav process and see what system calls its performing when misbehaving.