On other projects, we solved this by incorporating virustotal checking. Sure, a 0day or custom malware may get through, but thats a small number at the end of the day.