Hi
No, the .Cloud service does not have a 'disarm' feature.
With the basic Anti-Spam and Anti-Virus if an email is deemed as malicious the entire email is stopped and quarantined (only applicable to the Anti-Spam service if quaratine is enabled, otherwise it will be blocked and deleted) and can then be investigated if necessary.
Hope that helps
Thank you
Ian Tiller
Tier 2 Senior Technical Support Engineer