My experience has been to "Outsource" the problem. I use MailRoute and have all incoming port 25 ports blocked except from those coming from MailRoute. This way if a spammer does have my IP address it does them no good. Mailroute accepts all of my mail, scrubs it clean and sends me only the clean mail. No spam, no virus laden email, no having to worry about updates, Installs going bad. Nothing like that. I have been really happy with the service.
I don't know how many users you have, but the cost is fairly inexpensive.
The second solution would be to set up a seperate antivirus server and pass the clean mail to Scalix. With this solution you don't get the benefit of just blocking everything except the IP address range for MailRoute but its better than having the mail server handle everything at once.
You can visit them at MailRoute.net
Glad to see that Scalix is back online. I was sad to move on but I needed to.