One possible option is the exit point api IBM came out many many moons ago
to support vendors who sold virus scanning software for the stream file
portion of the IFS. With that the intention was that upon creation or
change a new file would be scanned for any viruses.
Perhaps you could snag on to that?