I have confirmed this morning that Symantec definitions version 5/17 rev. 73 no longer flag Pegasus Mail's main executable as a trojan.
We've been using Symantec AV Corporate Edition for 9 years now and this is only the third time I've seen a false positive, as this was for winpm-32.exe being flagged as "Trojan.Dropper" with one of the Symantec definition files. As with this false positive, each time Symantec fixed the problem in a newer definitions file within a day or two. My only contact with Symantec support was with the first false positive a few years ago now with the Sassafras KeyServer client and it was easy and they resolved the problem without a fuss, actually within a couple hours they had a new rapid-release definition file that removed that false positive. The other has happened a couple different times over the years, with the SFX code WinRAR uses. In any case, that Symantec support chat excerpt earlier in this thread is quite bizarre to me.
When this problem first happened to me last night, it was on my primary, old work computer which I had actually installed some new software about an hour earlier, so you know it very well could have been winpm-32.exe had been injected by some other trojan. I then checked my other work computer, which I hadn't installed anything new on for over a month and it too flagged it, so that made it less likely to be the real deal. After going to this forum board and finding this thread, it definitely was a sigh of relief, to know this was a false positive.
At that point, I simply added an exclusion to the folder where I installed Pegasus Mail and restored winpm-32.exe out of the quarantine folder. I don't know why people would need to be re-installing Pegasus, unless they had their AV settings set to delete, before quarantine. I especially don't know why one would have lost all of their settings, when all of the Pegasus Mail configuration files are left intact, only the single winpm-32.exe was removed. In fact, Mr. Harris might want to just have that file put on the FTP servers, along with posting the MD5 hashes of the Pegasus Mail and Mercury binaries, for future reference. Simply putting winpm-32.exe back in the program folder is all one should need to do, once the newer Symantec AV defs have been installed. I definitely recommend removing the folder/file exclusions, though, because it is still
possible for that program folder or winpm-32.exe binary to get injected with a real trojan.
Finally, I would suggest those ready to jump ship to a new AV product to
first do some real research. I'm not married to Symantec AV, in fact, the past couple years, I've tried out several other products, on my personal systems, but you know what, I keep coming back to Symantec/Norton. I've had false positives, spiked CPU utilization, and other various problems with other AV products I've tried out, as well. I haven't tried them all, so I'm not saying their isn't the "perfect AV" product out there, but in terms of problems, Symantec AV has still been the lesser of the evils that is infesting a Windows NT system with any AV products. If you notice from the
AV-comparatives report, in their testing, perhaps ironically, Symantec AV was the only one that did not have at least a few false positives.