SIMP installs and configures ClamAV. ClamAV is a command line malicious code detection tool.
ClamAV is scheduled to run once per day and scans /tmp, /var/tmp, and /dev/shm.
/tmp
/var/tmp
/dev/shm
References: SI-3, SI-3a.