> grep clam /etc/passwd
> clamilt:x:989:985:Clamav Milter User:/var/run/clamav-milter:/sbin/nologin
> clamav:x:985:981::/var/run/clamav:/sbin/nologin
> clamupdate:x:983:979:Clamav database update user:/var/lib/clamav:/sbin/nologin
> clamscan:x:982:978:Clamav scanner user:/:/sbin/nologin

Interesting.  The 'clamav' user seems not to have been created by the
same setup process which created the other three, since it didn't get
a text description.  There's a suspicious gap in the numeric IDs from
985:981 to 989:985 like the milter IDs were added later.  Make sense?

What does

grep clam /etc/group

give you?

grep clam /etc/group
clamilt:x:985:clamav,clamscan
clamav:x:981:clamscan,clamilt,clamupdate
clamupdate:x:979:clamav
clamscan:x:978:clamilt,clamav
virusgroup:x:949:clamupdate,clamscan,clamilt