One way computer viruses avoid detection is by hiding inside legitimate programs. Antivirus software can check whether these are larger than they should be, but viruses can disrupt this checking process.
Now Stuart Wray of Broadstone, Dorset, UK, and Icarus Sparry of San Jose, California, have come up with a different way to hunt for them. Instead of measuring the size of the programs directly, they suggest working their sizes out from looking at how much memory remains unused.
They measure this by filling the empty memory with a random string of data and reading off how much of it…
