Difference in update sizes ?

I don´t understand why a big update is about 30kb and a small is about 170kb, for example:

This one was about 30kb:

NOD32 - 1.1354 (20060105) / posted 21:57)
Virus signature database updates:
IRC/Flood (9), IRC/Small.O, IRC/Small.P, Win32/Anar.C, Win32/Bobax.AP, Win32/Bobax.NAH, Win32/Brontok.AX (2), Win32/Chilly.C, Win32/Delf.AA (2), Win32/DNSChanger, Win32/Guap.H, Win32/Honk.A, Win32/IRCBot.PH, Win32/Iroffer.1227.D, Win32/Kelvir, Win32/Lewor.AE (4), Win32/Lowzones.NAF, Win32/Mabutu.C, Win32/Mash.B, Win32/Mocalo.ND (2), Win32/Mops.B (2), Win32/Mops.C, Win32/Mytob.OA (2), Win32/Mytob.OB, Win32/Mytob.OC, Win32/Nanspy.NAA, Win32/Nanspy.NAB, Win32/Netsky.AH (2), Win32/Opanki.BD, Win32/Opanki.BE, Win32/Pawur, Win32/Pawur.F, Win32/Pawur.G, Win32/Pawur.NAC (2), Win32/PSW.Hangame.H (2), Win32/PSW.LdPinch.RG, Win32/PSW.Legendmir, Win32/PSW.Lineage.ON, Win32/PSW.QQShou, Win32/Randon (3), Win32/RiskWare.RemoteAdmin.NetCat.110 (2), Win32/Rootkit.Agent.A, Win32/Shelp.NAA (2), Win32/Spy.Agent.HZ, Win32/Spy.Banpaes.O, Win32/StartPage.NEW, Win32/TrojanClicker.Small.HB, Win32/TrojanDownloader.Agent.KW, Win32/TrojanDownloader.Agent.NDH, Win32/TrojanDownloader.Agent.YG, Win32/TrojanDownloader.Dadobra.FX, Win32/TrojanDownloader.Delf.WO, Win32/TrojanDownloader.Small.AFQ, Win32/TrojanDownloader.Small.AWA, Win32/TrojanDownloader.Small.CEO (2), Win32/TrojanDownloader.Small.NGF, Win32/TrojanDropper.Agent.AEJ (2), Win32/TrojanDropper.Small.NBG, Win32/TrojanProxy.Ranky, Win32/TrojanProxy.Small.NAG, Win32/Tsipe.AK, Win32/VB.NEA (2), Win32/VB.NEB, Win32/VB.NEC, Win32/VB.NED, Win32/VB.NEE (2), Win32/Wisdoor

And this one was about 170kb:

NOD32 - 1.1353 (20060105) / posted 16:41)
Virus signature database updates:
Win32/Adware.Toolbar.Shopper (2), Win32/Agent.NJ (2), Win32/Agent.PD, Win32/Delf.AIG (2), Win32/Robobot (4), Win32/TrojanDropper.Agent.ADK (2), Win32/TrojanProxy.Agent.HS

 

Simple answer... there's no set size for each definition. Some might require more code than another. Also could have added generic detection (for variants of the same thing) and remove redundant single definitions.

 

Also depends on how similar some virii are, meaning a simple code string could detect numerous baddies depending on how similarly they were written. If the virii are alike, the detection code/strings will be alike.

 

And don't forget that they can update different parts of NOD by using an update
A good recent example of this would be the server list.

After a number of complaints about u7 being offline all the time and making numerous lists of errors, they simply removed it with an update. It's back in action now though, but I'm just saying that the number of signatures should not be compared to larger or smaller update sizes.