clamscan: don't invoke a subshell