That's perfectly normal. It's not SME specific, nor clamav related, it's just the way the linux kernel manage the memory. As long as there's free memory, it'll be used for the cache (and the buffers, depening on the activity of the server). This improve the performances.