I'd second the opinion that scanning on-upload is too late, and you need to prevent anyone possibly getting that far.
If you have a copy of the site pre-hack, then you should really run a file-compare on it and make sure that you can account for everything that has changed on both the files and the database. They may have left a backdoor, even if you have removed all visible changes.
Many hacks do not use ftp, and most I have encountered are to add links for SEO rather than malware.
As such, your main job should really be to try and identify how they may have got in and use this as a lesson to increase security. If you are running a CMS (or any open-source software), than make sure it (and all extensions) are patched to the latest version - un-patched sites and badly written extensions are a very common way in. Password protecting any admin area via htaccess as well as the default log-in can also help prevent more automated attacks.
You could also lock your ftp down by ip if you are the only person accessing it and are in a position to update that when your IP changes.