Hi,
It would appear that the Spammers & virus writers have joined forces, and this combined with the latest hardening techniques the virus writers are using (multiple compression & encryption) is making increasingly difficult for the anti virus systems to detect them.

Egress filtering is the only way you are going detect compromises, I would do a bit of homework on this, as it is going to be a real problem shortly.