CLAMAV not working as expected

I'd recommend ensuring that your ClamAV definitions are updating properly, you can do this by running the following command via an SSH session:

/usr/local/cpanel/3rdparty/bin/freshclam

Also, have a look at Linux Malware Detect (commonly known as "Maldet"). It integrates nicely with ClamAV, and can actually use ClamAV's definitions alongside.

Outside of those two products, the good people at CloudLinux recently released a new, on-demand malware scanner called ImunifyAV, which you may like to research. Just note, though, that it's in Beta right now and so if you find rough edges using it, that might explain why.