Scan all uploaded files with ClamAV or your favorite malware scanner
You'll need to install ClamAV and php-clamav. You don't actually need ClamAV to use this plugin, though. You can use the system command to run another scanner that can accept input on the command line.
For example, you could scan with avira like this:
Your server admin has probably disabled the "exec" function. You'll want to talk to your server admin before moving forward with this plugin. They may be able to help, or they may have other security measures in place that mean you don't need this plugin.
PHP automatically deletes the files for you if they're not handled.
"The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed."
The only user input that is passed to the shell command is the original file name chosen by the user, and this is passed through escapeshellarg() to sanitize it. Otherwise, the only command that's run is chosen by you. It's left to your server admin (or you) to determine that it's safe for you to issue commands. This plugin should prevent attacker input from making it into the command. Let me know if you see any problems.
I haven't tested this with Multisite yet. If you have input, let me know.