ClamAV, worth running, it doesn't use many resources. Linux is popular enough now that it is an attractive target, especially with all the cloud vms running out there

If you run it behind a NAT, you'll need to run an internal virus database server. They rate limit downloads per IP. So fetch theirs once per day, serve as much as you want internally.