You cannot precisely "scan" the file on the client. However, some manipulations are possible, determined by the client's security settings. I find this to be quite difficult, as browsers implement this functionality in different ways (for example, Internet Explorer can use ActiveX scripts). You might try to learn this, perhaps.
As for the free antivirus, I think Google has the answer;) But seriously, Avast and AVG provide users with free versions of their antivirus. Since you did not say anything about your purpose of the server, I do not know if using free versions is legal.
If you are willing to pay a little for the AV solution, I can recommend NOD32. However, I must mention that I have no experience with the server version. I am using a version of the workstation that is very light.