People typically run an on-server virus scanner for this scenario, scanning during the submit is going to be slow and a vector for attack (if you can cause the server to do significant work each time you submit a form, you can take it down quite easily).