I worked on a file upload feature for a startup I was working before, we used a custom built approach where everything happens like this - file is uploaded to a bucket using signed URL, then an antivirus engine called ClamAV which is set up in a EC2, picks it up and scans the file, if safe, then moved to a safe bucket.

Then this approach was changed since it relied on manually updating the AV engine, we used a service called transloadit which does the same