More info:
I am running with the medium security setting.
My shared hosting is configured for a maximum execution time of 30 seconds and 128 Mb of memory. Running the memory test says 90 Mb was requested and it was able to get 82.5 Mb which it seemed quite happy about.
If I leave the execution time blank at the default the logs report:
getMaxExecutionTime() returning half ini value: 15
Got max_execution_time value from ini: 30
The scan then runs for 15 seconds and stops showing anything else happening.
If I set the execution time to 29 seconds then I get:
getMaxExecutionTime() returning config value: 29
Got value from wf config maxExecutionTime: 29
The scan then runs for 29 seconds and stops showing anything else.
It doesn't seem to make a significant amount of difference whether I reduce the memory option to 75 Mb or double it to 512 Mb (I wouldn't expect the latter to make a difference as presumably the internal limits are detected). 75 Mb actually words a tad better than 82.5 Mb but neither work as well as leaving the default alone.
Turning off 'Scan for signatures of known malicious files' allows the scan to process more files but it just means it is doing more in the time it has available.
To me it seems like something is going wrong when a new process is being forked but whatever that something is doesn't show in the activity log. For all I know, it being a shared server, the scan could be chugging along quite happily but not updating the activity log so I don't know about it.