There are a few points to consider here.
First, AV is not a fail-safe, catch-all mechanism for any malware. Even ignoring the blurred line between AntiVirus and AntiMalware (these engines function differently, even if they are packaged in a single product), there is no AV/Antimalware product that will catch customized, targeted attack code. So, if that is the threat you are trying to protect against, you can just as well forget that.
Secondly, if you are accepting file uploads from users (especially essentially anonymous users), you should play it safe and go for defense in depth - even it's trivial to get around AV, you can at least block the low hanging fruit - and the "innocent" victims who continue to spread the payload unknowingly.
Third, if you want to play it super-safe and have AV even if you don't need it, like @Tate recommended, you should realize that while you will be safer from viruses (again, low probability, but still exists), this is not free, there are costs involved:
- Using AV on the server can add risk to the server, since you're adding potentially vulnerable code - less code, less attack surface. (There have even been cases of attacks on the server via the AV interfaces).
- Checking for viruses right there on your server isn't necessarily the safest option, since these can potentially "leak" and fool the AV. (Also see George Ou over on ZDnet about defusing a bomb in your living room).
- Of course, never forget the performance costs of running AV on your servers, consider this an opportunity cost. Also you'd need to add X more servers to offer the same performance and throughput, if you have specific usage targets this can cost real money.
- Most server-ready AV have a non-negligable cost - more opportunity lost, and if you're spending security money there are better things to spend it on.
All that said, if/when you do decide to go for AV, consider the following points, including the obvious:
- Coverage
- Cost
- Updates
- reputation (i.e. do they actively research? what are their triggers? do they catch what they should? etc)
- Performance (or more accurately, performance hit - on memory AND CPU, and throughput)
- additional engines, e.g. anti-malware, loggers, anti-rootkit, etc
- Security of the product itself! You don't want to introduce vulnerabilities any more than you have to...
- VERY preferable - if you can offload the AV scanning to another box, e.g. appliance or gateway, so this isnt even ON the server. Or, there are (were?) some products that let you scan in memory, via an API call, without even writing to disk (or DB).