Thanks. I've considered scanning but besides that it's extra attack surface, delay, resources, and gives a false sense of security (it's trivial to make something for which there's not already known signatures), github and other file hosting sites don't do this either. Some do, I think Google Drive does it after the fact, but it doesn't seem to be the deciding factor in whether vigilantes try to take your site down versus report the malicious user content

Maybe it works to stop 90% of the reports though. It is worth considering, just a pain. Also because I used it for getting malware onto lab machines when I was investigating their network traffic patterns for my bachelor's thesis, I'd have had to constantly work around such an antivirus. If people would just not try to find other people's files by url guessing, they'd also not be upset by them