Thanks a lot for the info.
My defs are dated 3/10/2004 & NAV2003's email scanning was enabled.
Another thing - the infected email had 20 {names/email addys} in the header.
I've never seen that before.