Yes, as soon as it tries to become a file (e.g. in temp) your antivirus software's real time scanner will catch it. Until that happens, it cannot hurt you. It's text... mime encoded in your email db files.

Additionally, many ISPs do server side scanning of mailboxes. Not all though.

I generally never enable email scanning on anyone's computer because it invariably ends up stopping their mail at some point when it malfunctions. The only one to date that I haven't seen cause problems is Nod32's Imon (not the same as Emon which is specifically for Microsoft Outlook), and it's not really "email scanning" per se, but winsock level scanning. I have yet to see it bung anything up.