This is based on Stack Exchange podcast # 25.
I really don't understand why there would need to be virus checking on uploaded files. It would generally be a bad idea to execute anything which was uploaded, so, so long as you make sure the files can't be executed... Granted, I also use Linux for my servers, so I leave the "execute" bit off.
"so long as you make sure the files can't be executed"
Most formal theories of security are predicated on a logical expression of one or conditions. The problem with formal theories is they fail to anticipate behaviors outside the model. How do you make sure that the files cannot be executed?
Even Linux and Mac OS X/BSD machines occasionally come into contact with file systems that do not have execute permissions. Specifically, most removable flash media are formatted as FAT32.
Do your Linux machines automatically mount removable media?
Do you have WINE or another Windows compatibility framework installed?
If you answered yes to both these questions then congratulations: you too can be infected by Windows malware!
On the other hand if you virus-scan every file by default then you have less to worry about.
I disagree slightly with Hendrik. The main reason to check files for malware is to keep your own systems up and running efficiently. Then secondarily to keep your clients clean. If you lack the resources to operate, then fairly soon you won't have any. And virus scanning files is not really an onerous chore if you automate it.
The main reason to check uploaded files for viruses, is that you can claim that you used state of the art technology and processes to protect your clients.
Assume another user gets infected by a file downloaded from your servers. He might try to sue you or report your to the trade authorities.
The problem is that your core assumption there is, or may be, flawed in many circumstances. You say that:
It would generally be a bad idea to execute anything which was uploaded
Virus/malware checking on upload is to add a layer of protection because circumstances change, mistakes happen, vulnerabilities are discovered.
The server may not be executing anything - if it helps, think of it as a smarter disk. One user saves an infected file to the disk/to your server, another user copies the file off it. The server has never executed the file, yet it served as a vector for spreading the infection.
Therefore, it makes some sense to check the files as they are stored, even if the server itself is not necessarily vulnerable to the infections.
Without having listened to the podcast itself, I guess it depends what you are doing with the uploaded files. Just taking off the execute bit won't help, e.g. if someone uploads a php file into your document root then calls it's URL.
AV checking is very limited in detecting malware.
The best solution is to convert the files to a different format and be careful about file extensions - as discussed here recently.
