If you are sent a program written by someone so that you have the complete source code, how would you go about scanning the source code for any potential viruses/malware?
Note: While bugs and security risks in the program itself are also important to find, this relates specifically to malware written into the program.
You read the code. You try to understand the code. You take the code out to dinner and get to know it better.
You compile the code and play with it. Does the code like it when you tickle it in that area? What happens when you leave it alone? Does it ignore you? Does it throw a tantrum? Is the behavior of the code what you expect it to be like?
Besides getting to know what the code is like now, you have to understand what the code is like before. Talk to prior acquaintances of the code. How was the code like before? Was the code always like this? Did the code's behavior suddenly change one day? What was the cause of the change?
Only by getting to know the code and what the code is supposed to do, can you tell if the code isn't what you are expecting it to be.
