Had the same thing today
I had the popup and installed version 4.0. Norton warned me and quarantined the file, but I read on internet that anti-virus software tag these files because they look for wallet files. As Electrum software had to work with the wallet file, it is normal that it has to be installed. So I removed it from quarantine and installed it.
When I restarted the software, Norton locked it again, so I got suspicious and went to the Electrum site and installed version 3.3.8.
I then made my payment and everything went correct, payment arrived at correct address. So I was lucky.
I then did a fast system scan with Norton, and nothing was found.
But then Norton alerted me that there was suspisious large outgoing mail activity and that I need to run Norton Power Eraser. Also Norton blocked suspisious incomming brake-ins.
I disconnected my PC from the internet...

Does anyone know what the 4.0 software does besides the changement of the payment address and servers??

Thx