Hi Paul

Totara has an antivirus plugin ClamAV that can be enabled - depending on your setup your server or internet provider may also scan attachments for viruses.

Regards