http://www.f-secure.com/weblog/#00000782
An example of why universal accept-then-discard virus handling is bad.