Can a user spread virus on my Multisite?

Out of the box multisite has the same security as wordpress.com gives it users – being that it strips all kinds of extras, even if you are an administrator of your own blog. Super Admin has the basic WordPress permissions, everyone else does not.

no iframes, no javascript, no code.