ATM when ClamAv finds malware on upload it only shows a notice to the end-user.
We think it should also log the event in syslog at a minimum, e.g. log the datetime, IP, username/userid, filename, and clamscan result. Not sure how useful it'd be to put it in the moodlelog.