I believe that the machine did have a previous version of SAV on it, but I'm not sure. I was able to run the intelligent updater and get virus defs on the server but it is not updating to more recent defs - still seems to be a communications issue of some kind. Would it be possible to simply replace the C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate folder with the contents of a server that is working? I'm grasping at straws, yes.
Well, I just removed an old pcAnywhere, the Endpoint, a LiveUpdate and a LiveReg and reinstalled Endpoint - same result - everything works but no virus def download. It must be something on the box so I will just have to replace it and keep my fingers crossed.