You need endpoint protection like the product offered by WatchPoint Data. Your signature based AV is useless as Marcin found out early on.

This a terrible assumption. Your best bet is endpoint protection. Track the behaviour and you will find the threats your signature based AV miss. www watchpointdata com