I've not read through all the replies so this have perhaps already been said but I'll say it anyway just to be sure that you know. It's common practise these days that viruses use a fake from adress, one that have often been taken from the adressbook of an infected person. So blocking of "from adresses" will do you no good since you are most likely to block of ppl that aren't infected but whos adress is in an infected persons adressbook.
I know from personal experience how some ppl have complained about to me about one of my email adresses as being a virus sender. It was one that was very public and most likely would end up in numerous adressbooks. Funny thing was that none of my privat adresses would "send" out any viruses. As then I run a firewall and virusprogram updated daily aswell as an emailfilter program to block of spam and viruses even before they leave the mailservers. :-D
:idea: I'd rekomend you try to block email viruses by finding common factors in the header and body of a mail and preferably combine with other factors such as size of the mail.
