We run an unmanaged network here. What we do is post the update to the NETLOGON directory and when the user signs on, KIXTART checks their signature file against what we have available. Here is the the important code:

Code=============

$NavDef="1101" ;Only enter the month and day of the latest Norton definition file.
$Year="2001" ;Year used in conjuction with the Norton definition file below.
$Month = SubStr($navdef,1,2)
$Day = SubStr($navdef,3,2)

Select
Case $Month="01"
$Month="January"
Case $Month="02"
$Month="February"
Case $Month="03"
$Month="March"
Case $Month="04"
$Month="April"
Case $Month="05"
$Month="May"
Case $Month="06"
$Month="June"
Case $Month="07"
$Month="July"
Case $Month="08"
$Month="August"
Case $Month="09"
$Month="September"
Case $Month="10"
$Month="October"
Case $Month="11"
$Month="November"
Case $Month="12"
$Month="December"
EndSelect

:SIGNATURE ;Message stating current virus data information and warnings
$Selection = MessageBox("The current virus definition file date is "+$Month+" "+$Day+", "+$Year+Chr(10)+Chr(10)+"Do NOT Open, FORWARD, Or SAVE ANY E-MAIL with the following subject 'w32.magistr.24876"+Chr(64)+"mm'. Write down the sender's name and e-mail address, and the date/time stamp of the e-mail. Pass this information to the Help Desk. The e-mail must be deleted from the 'Inbox,' and also from the 'Deleted Items' folder."+Chr(10)+Chr(10)+"If you open an e-mail with this name or attachment; IMMEDIATELY DISCONNECT YOUR COMPUTER FROM THE NETWORK, (disconnect the LAN cable from the back of your computer) then contact your Workgroup Administrator/Manager and the Help Desk as soon as possible."+Chr(10)+Chr(10)+"Also be advised that the LIFESTAGES and FUNNY.TXT viruses are still being identified here at Niagara Falls and within the DOD."+Chr(10)+Chr(10)+"All AFRC PC users should be aware that they should be running a virus scan on their computers. And if they do open any virus infected e-mails, that they should contact their WGA And HelpDesk immediately. And that their system is considered infected and should be disconnected from the LAN until being sanitized and checked by the HelpDesk."+Chr(10)+Chr(10)+"DELETE THE MESSAGES IMMEDIATELY AND NOTIFY YOUR WGA AND THE HELPDESK!"+Chr(10)+Chr(10)+"Do you understand the importance of ensuring your Antivirus software is updated?","INFOCON: "+$INFOCON,4404)
If $Selection = 7
LogOff(1)
EndIf

:Virus ;This section checks for Norton Antivirus and gets the Scan Engine version.
$Norton=ExistKey ("HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus")
If $Norton<>0 ;Norton is not loaded
$Norton=1
Else
;This checks to see if the current definition is already present, when changing make sure to the the EXTENSION
;********************************************************************
If Exist ("C:\Program Files\Common Files\Symantec Shared\VirusDefs\$Year$NavDef.*") = 0
;********************************************************************

;This directory will contain the latest DAT files for Norton.
;********************************************************************
; Display some text strings
Shell @LDRIVE+"$NavDef"+"i32.EXE /q"
;********************************************************************
EndIf
EndIf

:NOANTIVIRUS ;Message stating that the antivirus software is not installed or needs to be reinstalled
;********************************************************************
If Exist ("C:\Program Files\Common Files\Symantec Shared\VirusDefs\$Year$NavDef.*") = 0
;********************************************************************

$Selection = MessageBox("WARNING... WARNING... WARNING..."+Chr(10)+Chr(10)+Chr(10)+"Your Norton Antivirus application needs to be upgraded."+Chr(10)+Chr(10)+" Contact your Workgroup Admininistrator immediately!"+Chr(10)+Chr(10)+"Click 'Yes', if you understand!","Norton Antivirus",4372)
If $Selection = 7
LogOff(1)
EndIf
EndIf