Put a sane email server in front of the Exchange one. Something like exim or qmail (not sendmail) -- then you can get virus scanning plugins for them that'll remove the virus before it even reaches any of that Microsoft crap.