The best solution for AV is definately clamav, however you will need to couple this with Amavisd (
http://www.ijs.si/software/amavisd/).
To tackle the spam, use spam assassin with baysian learning so you can 'teach' it spam (
http://spamassassin.apache.org/).
Alternatively to assist with cutting down the level of spam, check out "greylisting" (
http://en.wikipedia.org/wiki/Greylisting).
search on google for "your_mta +amavisd +clamav +spamassassin" and you will find mountains of websites with suggestions and walkthroughs.