Step 1: decide what virus-scanning product you want to use.
Step 2: find out what kind of API they provide for on-demand scanning.
Have you done these steps yet? No? Because your question is really
Step 3: find out how to use that API in a servlet.
So if you are still having trouble with Step 3, after having done Steps 1 and 2, then let us know. With details about what you found out in Step 2, of course.
Solution will depend on how you would like to scan.
1. In real time with a user notification and ask for re-upload
2. In real time with a user notification and automatic virus removing
3. Later batch scan with e-mailing to a user about found problem and asking to re-upload
4. Later batch scan with automatic virus removing
We use 4th approach since it less bothers a user and doesn't require API for calling scanning software. It provides also extra benefits, like what if virus get to upload on server side?