The possible options for this field are :

Standalone scanner (`clamscan`)
  This is typically the default, and will tell Virtualmin to use the ClamAV scanning program that does all of the work by itself. This is certain to work, but can be slower than the next option.
Server scanner (`clamdscan`)
  This option can be selected if the `clamd` virus scanning server is running on your system. It is generally superior, as the ClamAV virus database is quite large, and the server only needs to load it into memory once.
Remote server scanner (`clamd-stream-client`)
  This option can be selected if the `clamd` virus scanning server is running on a remote system, and has been configured to accept network connections from other hosts. It is useful for offloading the task of scanning to a different system from the one that accepts email.
Other program
  This option lets you tell Virtualmin to use some completely different program, such as your own wrapper script for ClamAV.