If you have server access you can also use "SpamAssassin".
It is free and trainable.

Sometimes your hosting company may already have this or it is tied into your web control panel (Ensim, Plesk ...). Check with that first and maybe all you need to do is configure it.

www.spamihilator.com is "free" and trainable.
I have not used this but it has good marks.

www.cloudmark.com is another "PC BEST" rated software.

And there are a bunch of other paid and free.
I personally avoid desktop filtering as it always messes something up on my system (thank you windows). Server based is a bit better (In my use). Options like AppRiver stops the spam from even hitting your server..saves your CPU resources, bandwidth, and a few other items.

Call your hosting company and see if they already have something in place. Something is better then nothing.