Does the host the clients are running on have AV? And are the shares scanned on a regular basis? This could be a good halfway house, but won't be able to detect in memory malware, but to be persistent, malware must write to a file "at some point" and when this happens if you are scanning all the mount points used within the thin client, then you should be able to detect it.