I am getting more false positives as well. Although I usually get more false positives when I do not set the service to "real time" as soon as the server reboots. There was a patch that forced my server to reboot, so I need to reboot again and set the service to real time. This is just a work around that reduces false positives in w2k sp3 and if I don't set real time I get many more false positives.
My observation is somewhere between Version 3 and 4 something changed and everyone is seeing more false positives. Using automatic export or any disk intensive operations (export backup) can and will cause false positives. So I believe the loop that is doing polling is somehow competing or conflicting with the loop that writes data.
Normis is there any way you guys will take a close look at this?