Have you tried to scan the samples with PUP scan turned on?

PUP = not virus / Possible Unwanted Program