The problem is a great majority of infected emails come from infected systems or botnets, so trying to track the origin down is going to be very difficult.
As to the legalities, that is probably an even bigger grey area as there is no 'worldwide' law on the subject of viruses. So assuming you did manage to track the originator (not the unknowing person with an infected system or part of a botnet), then the task isn't completed just entering a different phase.
Personally I don't wast any time in trying to track the origin of spam as it is often the same circumstances with little chance of nailing the 'true' originator compared with the effort to track them down and try to bring them to justice.
Unfortunately I think the same is true of viruses, for the most part these viruses or suspect email don't even get to my system as my anti-spam can also be useful in filtering out the suspect email too. Many of the emails are now phishing attacks, so there is nothing malicious in the email, just trying to fool you into visiting your bank/credit card/paypal site about security checks, etc.
I fear the reward in tracking any of these down is vastly out weighed by the effort involved, life is too short, just delete them and move on.
