1. A system implemented on a computer apparatus for scanning a computer file including source code of a computer program in a given computer language for malware, the system comprising: means for separating the source code into groups of constituent parts, each group comprising parts of a different type of structural part of the program; means for processing each group to count the number of occurrences in that group of characters of a character set to obtain a frequency distribution of characters in that group; means for comparing the character frequency distribution of each group with an expected range of frequency distributions; and means for flagging the file as suspect or not depending on the result of one or more comparisons by the comparing means.