Intel,Altiris Group

I'm not sure if this is a false positive or not, but the latest defs seem to be identifying some pcAnywhere components as "Trojan-Spy.Win32.Small.cad" on one of our machines.

We're getting Active Protection alerts about winlogon.exe trying to modify C:\Program Files\Symantec\pcAnywhere\awhk32.dll.

I'm curious as to whether this might be a new false positive that other people are seeing, or if maybe we actually have a problem. pcAnywhere has been on a number of our machines since before we started using Vipre, and it hadn't previously caused any problems.

This is probably unrelated but over the past few days I've found that the pcAnwyhere Host service on one of my Win2003 server's seems to be perceived by Windows Data Excecution Prevention as malicious software.  Nothing on the virus scanners though but perhaps having two sources of mis-identified malware may turn out to have the same root cause. 

What this is, at present, I haven't the foggiest. 

What components did it see as the worm by the way?  Was it just the host?