size(ntfile)

From SpybotWiki
Jump to: navigation, search
size[ntfile]
Variants size[ntfile]
Previously ntfilesize
Group Basic Attributes
Version advcheck.dll > 1.6.4

Defines which size the scanned file must have.

Usage

size[ntfile]=<size(int)>
size[ntfile]>=<size(int)>
size[ntfile]<=<size(int)>

Examples

size[ntfile]=18373
size[ntfile]>=10000
size[ntfile]<=100000
size[ntfile]>=10000,ntfilesize<=100000

Description

Compares the size of the currently tested file against the specified size parameter. Next to a strict comparison, this one also allows lesser than or equal and greater than or equal checks. This is the version preferred for rootkits, since it uses native NT methods instead of the Win32 API, where files may be more likely to be hidden.

See also

Similar parameters

Similar commands