If you are using a recent version of MS then you could create a normal SA rule and do something like this :- SpamAssassin Rule Actions = MYSARULENAME=>delete -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.