Well the SSE2 problem was clear (looking back, of course) - we updated the compiler and it started to include Spectre mitigations in the code... which caused the code to crash on systems without a SSE2 support. The crash happened during the "preparation" phase of the virus definitions which resulted in more and more ("unprepared") virus definition folders to get created on disk - because only the older folders than the one currently used are automatically removed, and here the current was a rather old one (the one before the compiler got updated). So disk space got consumed. (On one hand, it was kinda lucky that the crash occurred during the preparation, and not only later during the actual scanning - because the machine remained protected with the old virus definitions. On the other hand, if the preparation finished successfully and it crashed later during scanning, the program would show as unprotected - and we'd probably notice faster).
However, that problem has been fixed - you can see that the "latest" number in aswdefs.ini get updated and the older virus definition folders are (with some delay) removed; those were the ones that occupied your disk space.
I don't know about other files being created though... sure, during a virus definition update, the relevant installer packages are downloaded (but that has always been the case and that part is program code so it didn't change), they are extracted and their code is called/used. The virus definitions don't create any files automatically... they can create temporary files during archive scanning, but nothing "out of the blue", right after the update.
Let me repeat once again though - when virus definitions are updated, you may "lose" something like 200MB at that moment, that's normal. There are two virus definitions loaded for some time; the old one should be deleted (and the disk space reclaimed) after some time, let's say half an our - depends on what's going on on the machine though, the time may vary. There can even be a bug in some of the code causing the first definitions to keep loaded; in that case, after the next virus definitions, three different definitions will be loaded for some time (and another 200MB disk space is "lost"). However, that shouldn't grow much farther... plus, regarding the virus definitions, if you reboot the system, they are cleaned up and only the last one remains (so the disk space grows).
If you're saying that even after a reboot (when there's only one virus definition folder - not counting those with _stream suffix, they are small) the disk space remains lost... well I'm afraid you'd need to find where it is. You can use Total Commander to search for files not older than X hours and bigger than X megabytes... you can compute the sizes of the folders on the C drive (Alt+Shift+Enter) and you can watch which one did grow (and remained up!) and then go one folder down and do the same etc.
I'm afraid that without knowing where the space is, I really can't say much more.
(There might be ways to lose space that really wouldn't show as files... maybe System Restore points? Don't see why virus definition updates would create them though. Or someone writing huge blocks into NTFS alternate data streams - but that would be even more weird.)
