It's actually a bit different, but the basic idea is the same.
Virus databases are labeled as XXXX-YY.
YY are always increments to YY=0.
I.e. 0566-1 is downloaded as an increment from 0566-0, 0566-2 is an increment from 0566-0 etc.
Then, there's an increment from 0566-0 to 0567-0, 0567-0 to 0568-0.
XXXX is currently incremented once a week (on Monday, there's usually VPS XXXX-0).
This scheme has proven to be most effective (otimal bandwidth usage).