If you don't want to handle virus scanning yourself, you could try requiring users to upload files from a trusted source. For example, Google Drive virus scans files under 25MB - you could have users upload to GDrive, then select files using the Drive API.