ClamXAV is free, which is, of course, very attractive. However, the
product is misleading. ClamXav is an OS X port of ClamAV, which is a
UNIX server anti-virus application for use with Windows networks. (For instance, ClamAV comes with Mac OS X Server.) The problem is that ClamXav uses ClamAV's
anti-viral database, with few additions in consideration of the
Macintosh.
You can search the ClamAV database here:
http://clamav-du.securesites.net/cgi-bin/clamgrok
As a test, do a search for, for instance, for "Macintosh", or for one of the
known (though very rare) Macintosh Trojans, for instance: "Opener" or
"Renepo," and see if anything shows up. (Nothing will.)
What this means is that ClamXav doesn't look for much in the way of
Macintosh-specific malware. Sometimes free isn't a good deal.
In addition, if a Macintosh-only virus were to appear in the wild, there is no indication that the ClamAV database would be updated to deal with it.* (The developer of ClamXav has admitted that not only has he not contributed any Macintosh definitions to the database, but that he doesn't know how to write such definitions.) *Note that all of the commercial anti-virus program developers aggressively seek out new malware threats and share collected examples of these threats, allowing them to quickly push out an update to their software that will protect users.* There is no one from the ClamAV project that is doing this for the Macintosh.* So, the ClamAV folks might never get an example of a new Macintosh Malware threat, and even if they did, there is no indication that there is anyone who would update ClamAV to recognize that threat.
In other words, ClamXav is practically worthless for use with the Macintosh, and worse, I fear that it lulls Mac users into a false sense that it is protecting them, when in fact it doesn't protect them from much at all. (It does provide protection from cross-platform Word and Excel macro viruses.)
Since ClamXav does not scan for Macintosh-only viruses, if you use Classic, ClamXav does not protect you from any OS 9 viruses, which can also infect Classic. It also does not scan for the three known OS X Trojans in the wild, or the "Concept" Trojan (which is not a real, or malicious, Trojan, but it does sort of provide a model for someone who wants to create one, so it would be nice if your anti-viral software identified derivatives of it.)
Also, ClamXav does not disinfect infected files and software. It can only flag such software for you. You then have to delete such software to be rid of the virus.
ClamXav also does not scan files interactively.
ClamXav *is* good at scanning for, and detecting Windows viruses on your Macintosh, but that is of questionable value, as these are harmless on the Mac, and they are easy to detect and just trash. (Usually they manifest themselves as gibberish e-mail attachments.) A Macintosh is highly unlikely to spread Windows viruses to Windows users, so software to detect Windows viruses resident on a Mac is of questionable value.
I simply don't see ClamXav as being a substitute for a commercial anti-virus program.* Admittedly, you probably don't need any sort of anti-virus program to begin with, but if you feel that you do, you probably want one that is actually going to protect you from conceivable threats.
The gentleman who has ported ClamAV to the Mac, and who is providing ClamXav for free, is to be commended for providing a free product to the Macintosh community. However, even though he does not disagree with any of what I have said above (this all came up on Macintouch), he also doesn't clearly state it on his Web site. So folks are lured into thinking that their Macs are completely protected, and will be in the future in the event of a very serious threat, when they aren't. That does the Macintosh community a very serious disservice.
If you feel that you need a program to protect you from Macintosh malware, I recommend that you purchase a good commercial product that can actually do this. ClamXav cannot.