I copped for the little blighter earlier this week. Suspected it, NAV (on auto update but with incoming mail scan disabled) caught it when I moved it to the desktop 'just to see what happened'.
Like others have said, if Norton can catch it, why can't reputable ISP's do the same?
Tim