[fineman]

This very specifically is an argument against scanning on the distribution end.

A false sense of security hurts more than deleting STONED.EXE (and likewise, all other malware caught by signature) helps.

Point to a modern virus scanner and also list what you've found in the archive. That gives a good baseline for people to check against without promising to have made anything safe to touch without scanning.