diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index daaf8c6..a5e07e4 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -969,7 +969,7 @@ for scanner in "${AVAILABLE_SCANNERS[@]}"; do
                     # Check for stalled scan (no log growth in 60 seconds)
                     if [ "$current_size" -eq "$last_size" ]; then
                         stall_counter=$((stall_counter + 1))
-                        if [ $stall_counter -ge 300 ]; then  # 60 seconds (300 * 0.2s)
+                        if [ $stall_counter -eq 300 ]; then  # 60 seconds (300 * 0.2s) - log only once
                             log_message "WARNING: ClamAV scan appears stalled (no activity for 60s)"
                         fi
                     else