Anything that's been known for weeks can be stopped at the point of ingress such as the email server. They don't require a process actively taking up resources on your machine monitoring disk activity.

What about attachments with passwords? Or https? (assuming we're not using stupid ideas like ssl unpacking proxy)

Blocking and filtering email attachments is pretty easy. There's plenty of email gateways that remove attachments from unknown/unsafe senders and replace it with hoops a user has to jump through to get the attachment. This is enough to discourage users from opening most malware.

For websites, malware hosts can be easily blocked at the gateway level. This won't protect you if someone manages to host malware on a common site like yahoo.com but will catch the vast majority.

These days it's pretty easy to circumvent or disable Antivirus or obfuscate your malware form it. If malware manages to get itself onto a user's machine then you've already lost.

Some systems will scan the email content and try to guess the password; if they can't, they'll block the attachment.