Have been getting >100000 detection of these viruses since 2 weeks ago. I think it has reached a point that it is actually affecting the server's performance, are there any way I can stop this? I'm running Plesk 7 with qscanq and clamav. This is on the P4 server.

Viruses detected:
Trojan.Dropper.VBS.Zerolin-3 - 20920 Time(s)
Trojan.Dropper.VBS.Zerolin-enc - 142282 Time(s)

Have you looked at your server logs to see if it's a single person sending all of those? If they are coming from a single email address or IP, then you could simply block it in your MTA and/or firewall.

How can I find out who sent this or where is this email supposed to go to? I have checked /var/log/secure and sort out all the IP but I don't see any suspicious one.