said by nwrickert 
:Some malaware is desighned when clicked on to disable your A/V.
The malware still has to be loaded into memory before it can disable A/V.
The only way clicking on malware can disable properly functioning A/V, is if that malware is not currently recognized in the A/V virus tables. In such a case, incoming mail scanning provides no additional benefit, since the malware would not be recognized there either.
I'll have to disagree with this I have seen where the a/v did catch it but it still disabled the A/V and the task manager and regedit.
