Have you tried to scan the samples with PUP scan turned on?
PUP = not virus / Possible Unwanted Program