Hi Scarlito,
I was wondering what would happen if you tried to stop your SEP client with the smc.exe -stop command and then try to start it again (smc.exe -start)?
When I do this in our environment I see that the SEP client will not start up anymore.
I'm not exactly sure but I think the service was running in service.msc, but the client said something different. The only way to start the client was rebooting.
We also saw that a simple EICAR test virus was not detected even when the SEP client was running and the GUI indicating that the computer was protected. Can you try this as well?
Because of all these behavior we added some exceptions in the snapvol.cfg for the SEP client. These exceptions have solved the problem that the client could be restarted/stopped and also that a test virus was detected again.
As a result of these actions the performance improved when starting applications (30+ to 14~18 seconds) and very minimal when logging in. Maybe it reacts differently for you.
By the way, is your case closed at Symantec or is it still under investigation?
I look forward to your response.