If you want to eliminate all real-time protection, the gui can be
misleading--the best way to do this is to follow the "workaround" paragraph
in this KB article:
http://support.microsoft.com/kb/892375 End users may be prompted to allow or
block administrative actions that originate from a central management tool
after they install Windows AntiSpyware (Beta) on a computer that is managed
by Systems Management Server 2003
(This article may also be of interest to your client, depending on the size
of their network--it discourages installation in a managed environment--with
good reason.)
It'd be interesting to see whether eliminating the real-time protection,
which is provided by a driver that uses a shellexecute hook--eliminates your
performance issue. I suspect that this would indicate a software issue in
your environment.
Many details about this beta product will change significantly with the
release of beta2, which should come later this year or early next--one way
for the client to deal with this issue would be to back off and look again
when beta2 is released.
--