I have often wondered that as well.  Anyway, this is the link I have used in the past >> http://community.arenachms.com/arenadownload/ I believe the Download Patch button will give you version 2009.3.  

When creating a new site on the same server to be served by Arena, is it necessary (or required) to create an entirely new website in IIS with another copy of the ArenaChMS folder as the document root or will Arena serve up the second site based on matching the domain with a value found in the default_domain column in the port_portal table?