vaughnh,
You are basically correct. When a virus is identified, its' signature (or fingerprint) as you put it, is added into the vps database. Most viruses must be "coded" in a certain manner for them to infect, therefore, once the basic code is identified, all that is needed is to "delete/move or repair the virus file".
Each vendor releases new updates on their own schedule depending upon how many new viruses are found in a certain time frame, and the "risk level" of each.
Sometimes, more than one update can be released in a day!
Avast team stays very productive as far as new virus database updates, and the PRO version has the Push feature which allows the Avast team to "send" you a new update and install it on a moments notice! Now that is the way to go! In general, one update a week is normal, but I have gotten as many 2-3 in a 10 day period!
As far as how Avast discovers a new virus.....well, I think Igor would be best able to answer that one.
Hope the info helped you.
Techie101