Anti-virus is not included with the server.
However it is real easy to integrate a virus scanner that can be invoked on the command line into the server by using the conversion channel. Take a look at the documentation for more details on it but in a nutshell you just write a wrapper script arounf the virus scanner that the conversion channel will call and let the script trap the return values form the scanner.
So as for cost you'd have to contact Symantec or McAfee as well as contact them for details on how the pattern files are updated. I suspect it is via another command line utility.