|
Defines which size the scanned file must have.
Usage
size[ntfile]=<size(int)>
size[ntfile]>=<size(int)>
size[ntfile]<=<size(int)>
Examples
size[ntfile]=18373
size[ntfile]>=10000
size[ntfile]<=100000
size[ntfile]>=10000,ntfilesize<=100000
Description
Compares the size of the currently tested file against the specified size parameter. Next to a strict comparison, this one also allows lesser than or equal and greater than or equal checks. This is the version preferred for rootkits, since it uses native NT methods instead of the Win32 API, where files may be more likely to be hidden.
See also
Similar parameters
Similar commands
|
