Hi Oxygen
Have you thought about approaching it from a firwall perspective? Preventing the download of executables via the use of a firewall rule?

Hope this helps