Let's say I have one server called A which host an upload website which is connected at the network connection B. Let's say one of my clients uploads multiple .rar files of 1 MB (that contains malware parts) and when I unzip them I rebuild the malware. Is there a way to detect that malware parts before I unzip the files?

Can I have a firewall/device that will check all the files between A and B and block them? 

Is this technically possible?

Your option 1. is a bad idea: in addition to the User-Experience / Public-Relations reasons you state, you're also giving attackers a window to intercept the password reset tokens and compromise every account on your server. It also doesn't solve your problem if you have even one user who's too lazy to log in / update their password.

At first glance, both 2. and 3. seem fine to me. Your #2 is no less secure than what you're doing now, but 2. would mean you have to continue supporting the current weak login forever (or do something like "After X months we're wiping your password and forcing you to do a recovery" which breaks the nice user-transparency you want, so let's ignore that).

Let's consider the case where you have users in the DB who will never log in again. With both 2. and 3. you have to continue to support the current hashing alg in your code-base forever just in case they do log in, but at least 3. has the advantage that they (or rather, you) are protected against offline brute-force attacks if your DB is ever stolen.

Since you'll have to keep the "old style flag" column around forever, do yourself a favour and make it an int not a bool so that if you ever have to update your password hashing alg again, you can record which old style they are on.



UPDATE: A very similar question was asked here and built on the discussion from this thread.
