we plan to setup virtual OS environments using VMWARE and infect the virtual OS with viruses & malware. we are going to make instructional videos from the VM's for users to show them the damage potential if they don't apply common sense and due care.

where can we go to get viruses?

p.s. this is going to work, right? i assume if you lauch malicious code within a VMWARE session - is can't escape the VM.