Attachments in Teaming can be stored in the database OR on the filesystem of the server.  So if you're using the filesystem method (which is the default) you should be able to scan all the attachments.  Check the ssf.properties file for root.data.dir and scan that folder hierarchy.  

As for adding a virus scanner, the current plan for the next release of Kablink is to have hooks in the entry processing engine that will allow custom Java classes to get called during processing of entry events like create, update, and delete.  I'll put something up in the forums or on the blog when we have something working.