This is old, but digging around I found this:
https://gist.github.com/brianroth/397334
and this:
https://github.com/steveking13/clamdstream
I have successfully used the latter.
The problem seems to be that the clamd daemon with CONTSCAN attempts to read a file from a path on a local file system, so you cannot simply replace the CONTSCAN with an INSTREAM.
Another option would be to share the filesystem between the two systems. This wouldn't be something I would want to do over a WAN link.
Both the linked code examples take a hostname and a filename, then open a connection to clamd and provide it with the appropriate data, it will then return a response.
The python code seems better suited to amavis integration. Python is installed by default on most distros, too.
Anonymous example from my mail server (using clamdstream):
Feb 14 08:36:57 hostname amavis[14549]: (14549-05) Blocked INFECTED (stream: winnow.malware.test.eicar.com.UNOFFICIAL) {DiscardedInbound,Quarantined}, [::1]
:33166 <emailaddress> -> <emailaddress>, quarantine: X/virus-virusid, Queue-ID: queueid, Message-ID: <UUID@domainname>, mail_id: virusid, Hits: -, size: 1111, 846 ms
Feb 14 08:36:57 hostname postfix/smtp[19829]: queueid: to=<emailaddress>, relay=127.0.0.1[127.0.0.1]:10024, delay=39, delays=39/0.01/0/0.85, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=14549-05 - INFECTED: stream: winnow.malware.test.eicar.com.UNOFFICIAL)
The "stream" in the "INFECTED" report identifies that amavis streamed the attachment.
Regards,
--
Steve