First off, you assume that all GPL code is stable. The license doesn't make code stable, programmers do. I know open source initiatives which still lack the stability you claim it should have. I also know closed source applications that haven't crashed in ages.
Second of all... Compilers tend to optimize code, play with it til it fits. Every compiler has different strategies of handling code. Also consider that machine code on UN*X looks different from that on Win32. GCC on Win32 geenrates different opcode than it's equivalent on any UN*X box or than Visual C, or any other compiler for that matter. Specific calls can be detected but not the amount of code you're refering to (unless Microsoft is stupid enough to leave the vendor details still in the code they're presumably ripping. The DoubleSpace - Stacker incident is one fine example of that). Let's also not forget the executable encryption/compression tools a la PKLite.
Last, if you are going to generate source signatures of every GPL (or open source) project and compare them to every product Microsoft releases/released, it'll take some time. You'll end up with more false positives than there are monks in this monastery :) Virus signature databases are already quite large and they scan for specific parts, not code that changes from compiler to compiler.
Just my 2 Eurocents
Greetz
Beatnik
... Quidquid perl dictum sit, altum viditur.
Comment on Re: using Perl to look for GPL code in M$ OS binary/source?
Getting even further off-topic: virus scanners don't have to worry about differences between compilers, as the assumption is that the (inadvertant) coppies are being created of the compiled binary, and not by modifying and recompiling the source.
We are using here a powerful strategy of synthesis: wishful thinking. -- The Wizard Book