Virus purveyors love to put their code inside proprietary compression. Many of my virus scan attempts fail because it can't see inside the archives.
Is there a way to run the .exe inside a chroot style container while the virus scanner looks at what goes on? That is, something simpler that starting up a whole new VMWare instance? Is there a virus scanner that can scan on-the-fly as the file decompresses?
Are you using the consumer version or the Enterprise version of McAfee products ???