SmartDefense spoolss false positive?

[ecorreale]

When my users use a VPN connection I start getting alarms about a CIFS Worm ID CPAI5201, //spoolss attack from the VPN client to a single print server. It's always the same print server and always from clients that have that printer installed on their systems. The common printers for each client are an HP 9000 and an HP800 series plotter. These alarms stop if I stop the spooler service on the vpn client. I have scanned the computers with Norton AntiVirus using the latest DATs, no virus or worms found.


Is this a false positive, or am I missing something?

[czech12]

It could very well be a false positive. If you have verified that there is no virus on the machine, I would say that's what it is...

[maverick]

I have experienced the very same thing, it must be a false positive

[kva.kva]

From SK
"A number of "false positive" issues relating to SmartDefense rule drops have been resolved by applying the latest HFA in conjunction with the latest update SmartDefense version." Please, check this.

And from me. You can try to set monitor only options for SmartDefence->Microsoft Networks parameters (may be only for File and Print Sharing).