Security question

[Joel Hammer]

Just thinking about the nasty stuff that windows users might shove up on my
linux samba server makes my blood boil!
Seriously, it seems like bad practice to let just any user save to a 
common directory, download from it, and to erase/change any files he/she
wants to. During the last worm (nimda), samba servers could be used as a
nidus of infection by transmitting the worm to windows clients.
It strikes me that there is an "easy" solution for this.
Would it not be possible to have two shares for clients.
One share is read only, whence the client may download files to his/he machine.
The other share is the upload share. The client would save his/her file
here. Then, a daemon on the samba server would:
1. Scan the file for viruses/worms, in fact, any executable or file not
meeting certain strict requirements.  If the file is rejected it is
sequestered in a directory which cannot be seen by the clients.
2. If the file is accepted after step #1, it is moved to the download share.
If a file of the same name already exists, the old file is renamed and moved
to a directory not accessable by the clients.
This sounds like it would make it difficult for malicious users or progams
to do mischief on a samba server.
I haven't thought about the file locking issues.
Any comments?
Joel