If you have already a f/w solution you can implement a solution based on Alladin's E-Safe where it checks all incoming traffic such us e-mail attachements, activeX/java/cgi/etc and will discard the content if questionable. 

Regards,

Spiros