Not going for the original joke I saw that Vista is malware... It is definately possible that some accounts have malware that is only started when their account logs in. So it would be safer to scan on each logon. For example, it is possible to modify the properties of a malware so that it cannot start or run properly. In this case, a malware scanner may not be able to find it, even though it is still present. I'm not sure how concerned you would be about having remnants sitting around.