Detecting a lot of spyware, 13190 (Smoke.Loader Command And Control Traffic)

[mfcuns]

I have a user that's triggering this alert frequently when doing normal Internet browsing.  Some detections are to bbc.com and other news outlet sites..  Nothing obvious comes up when analyzing the computer, so I was wondering if I could find out exactly what this signature is looking for.  I already checked the Threat Vault and it only provided the same information my PA device did.  Thanks in advance!

[zarina]

Hello,

This might be a case of false positive. Please open a Support case with the tech support and pcaps as suggested in the document so that we can further look into this.

https://live.paloaltonetworks.com/docs/DOC-2769

Thanks!

Sri

[robertb]

What was the result of the Smoke.Loader spyware.  We also saw a significant number of matches to this signature around July 5th/6th and nothing since then.