Due to the CPU/disk resources needed for spyware scanning, I only do scans by hand from time to time. I *DO* have realtime scanning enabled on most clients though.
Because manual spyware scans do not happen frequently, the latest spyware definitions do not get updated frequently.
The only way I have seen that spyware definition updates get pulled by the clients is if a Spyware "Scan and Repair" setting is included in a VULSCAN's command line.
I would very much like to be able to push out new spyware definitions for the realtime scanner without actually performing a VULSCAN spyware scan.
Surely there must be a way??