There are a few ways to combat virus/malware spammers.

1. Crowdsource identification of sites that are spam. Allow users to both deport and mark posts/comments as spam. Not only will this flag the user, you can parse any URLs posted and auto-block/remove them.

2. Don't allow any user to create a post if they have less than 200 comment score. They must be an active participant of the site.

3. For any users under 1000 post score, place the post into a validation queue. For example, a random selection of trusted users (say 500+ comment or post score) will have a question display to "validate" a random post. This can be placed at the top of the feeds, and it can be a quick yes/no. If enough people say NO, the post is flagged as spam and rejected. If enough people YES, then the post is approved. Trusted users will be offered 3 random posts to approve/disapprove as spam, and they can always allow them to continue to do more. This can also be used to establish a new "badge" score for community involvement.

4. For users with less than 1000 comment/post score, enforce a CAPTCHA.

Just some ideas. It's only going to get worse, so best to do it now.