Speak to virus protection, please.
I'm guessing that files attached to records on the CRM containing a virus are not likely to harm the server as the server never opens them. However, it is possible that someone sharing that file, not its owner, could be exposed.
I know that usual installations are never available to folks outside of the company, outside of the IT sphere of control but, in my case it is.
Please, enlighten me on the issue and remedies.