Technically it is not a malicious program if it asks for permission (and for added security add a nonliability statement the users agree to).

How it would work is if somebody uploads something the server does a virus check with any kind of antimalware and then any known worms or trojans do not get visibility or just explicitly do not get published at all.