Getting rid of catchall accounts helped me a lot. Don't bother to send a response back as in my situation, if a valid user sees a kick-back, they look up the proper email address.
Also, upstream virus blocking by the web host - like spamhaus, spam assassin, etc. helped a lot.
I use Outlook 2003 and Norton Anti-Spam on the local PC. Going to let the Norton Anti-Spam subscription drop as Outlook catches 99% of the spam that hits my pc and Norton Anti-Virus catches all the virus emails.
I get about 40 spam's a day, and maybe 1 virus email every few weeks. Use a couple of dozen email addresses. Most of spam/virus emails go to two email addresses - the one used for my major isp, and one that I've been using for about 10 years. The one I've been using for 10 years used to be on web pages as a "mail:to" link, and I also used to post to news groups with it.
Now, I never use mail:to links - only web forms - and I post to news groups using a hotmail account that deletes all incoming mail. some people claim that url encoding a mail:to link keeps the email address harvesters from gettin your address, but I don't think it's a great leap for a spam harvester to look for an encoded @ instead of a character one.
EDIT: Did a test for a client a while back who wanted his email address in text instead of using an image of it linked to a form. He got a spam within an hour of putting a test email address on a page. I've read of people who got a spam within 10 minutes of posting an address.
Edited by dpyers