ii samba-vscan 0.3.6cbeta5ebox1-2 Samba virus scanning VFS module
well you do seem to have the samba virus scanner installed. Don't know why that should be, but clam is used by squid to virus scan your web traffic (IIRC).
What filters are you using with IPCOP? URLFilter is pretty light (depending on the size of your lists!) but COPFilter (which does the additional stuff like virus scanning is a bit heavier)
The thing is that ebox isn't just a firewall/gateway system so it has lots of fat compared to the more targeted distros out there.
If you're looking for just a gateway/proxy setup without wanting to integrate all the other services that ebox has you might want to look at pfsense http://www.pfsense.com/
It's got all the load balancing fail-over stuff you want (as well as a ton of other stuff that ipcop can't do) and should use a lot less ram.
OK, but why squid use clamav? i think that if i dont select antivirus is because i dont want that squid scan virus in webs. Ebox have a serius problem with dependencies. In other hand, ebox use clamav 0.94 and this version is been deprecated (
http://lwn.net/Articles/355643/).
With ipcop i use dansguardian with a lot of lists, BOT, openvpn, l7filter, Advanced QoS. And i dont use copfilter because is not very stable.
I know pfsense but have several issues with multiwan/failover/loadbalance setups, i know that in version 2 (aka 1.3) will be solved but they are waiting that freebsd 8 was stable to release pfsense 2.
thanks and sorry about my english