They aren't doing code updates via any automatic mechanism. You can check
the date of your last definition update by this procedure:
1) do a file, check for update.
2) then go to Help, About, and look at the definition number and date--the
data will be, I think--the actual date and time that set of defs arrived on
your machine.
I believe that you and others on this thread are seeing something real, but
it isn't seen by the vast majority of users, so it is hard to pin down.
Another set of reports that I suspect are related to what you are seeing are
those where the users report that either their screensaver never kicks in,
or that their machine never goes into standby.
I'd bet that you can eliminate these issues by disabling real-time
protection, using the work-around paragraph in this KB article:
http://support.microsoft.com/kb/892375 End users may be prompted to allow or
block administrative actions that originate from a central management tool
after they install Windows AntiSpyware (Beta) on a computer that is managed
by Systems Management Server 2003
However--that takes away much of the value of the program.
