There are a couple of issues there:
1) Regarding antivirus/antispam software, treat those as separate products
on the server. A good antivirus software will include client monitoring as
long as you by enough client licenses to monitor all of your clients.
Symantec, Trend Micro, CA, NOD32 all play in this space. Each environment
is different and each sysadmin has their own preferences. Download trial
editions and test drive them until you find one that *you* like. After all,
someone could praise Trend Micro all they want, but if it breaks your LOB
custom-written inventory application then all that praise does you no good.
Testing for yourself is the only *real* solution.
2) Treat Antispam the same way. Although some companies may 'bundle' their
packages, when installed they still operate very differently. As well they
should since are trying to accomplish different goals. And maybe you like
Symantec's corporate AV product but not their exchange-aware antispam. So
you may end up mixing and matching....NOD32 for AV and GFI for antispam.
But the only way to find out is to download and test. Each sysadmin has
their own preferences for ease-of-use vs configurability, so there is not a
whenever possible my installations include a UTM firewall with spam
filtering. That way I don't even have to install "yet another" product on
my SBS box at all. Spam is stopped before it gets there. But that is a
personal preference.
3) As far as monitoring for compromised machines, no product will do this
accurately. Antivirus software should be viewed as a protective measure.
It is good at keeping bad stuff off of your machine, but if something bad
*does* get past the AV then why should you trust the AV to know it. The
malware has already shown that it circumvented the AV once, so it could lie
to any heuristics engine the AV tries to employ. Or simply disable the
product in the background and sent false "ok" messages to the monitoring
server. The simple truth here is that spotting an infected machine requires
diligence on the part of the IT department. Reports of a machine behaving
poorly/slowly is a good sign. Monitoring the weekly usage report will show
any malware using Exchange to send mail (unlikely, BTW.) And monitoring
firewall logs (you do have a firewall, right?!?) will reveal any machines
attempting to run their own SMTP server for spamming (far more likely.) So,
as you can see, finding a bad machine doesn't come from one piece of
information such as an AV snap-in, but comes from aggregating *all* of your
sources for information with a pinch of plain old experience added to the
recipe.
Hope that helps,
-Cliff