7. A method for scanning a computer file including source code of a computer program in a given computer language for malware, the method comprising: separating the source code into groups of constituent parts, each group comprising parts of a different type of structural part of the program; processing each group to count the number of occurrences in that group of characters of a character set to obtain a frequency distribution of characters in that group; comparing the character frequency distribution of each group with an expected range of frequency distributions; and flagging the file as suspect or not depending on the result of one or more comparisons by the comparing.
7. A method for scanning a computer file including source code of a computer program in a given computer language for malware, the method comprising: separating the source code into groups of constituent parts, each group comprising parts of a different type of structural part of the program; processing each group to count the number of occurrences in that group of characters of a character set to obtain a frequency distribution of characters in that group; comparing the character frequency distribution of each group with an expected range of frequency distributions; and flagging the file as suspect or not depending on the result of one or more comparisons by the comparing. 11. A method according to claim 7 , further comprising: maintaining an exception list of files which by their contents are to be treated as exceptions; identifying a file as being included in the exception list; and wherein a file is not marked as suspect if it is identified as being on the exception list.