You know don't you that these spam results offering fake or virus files are autogenerated by systems set up by groups similar to Overpeer. Google Overpeer to get an idea of what I mean. These groups do not use static ips. So you might ban specific or ranges of ip's one day, but they then switch to another range. Also those ip's you banned are then taken up by other poor innocent souls.

Try using your Junk filter as much as possible. It's a dynamic learning filter & takes time to be trained. For simple autogenerated results it's quick to learn to filter it out. But for viruses, it's a different story. You need to persist.