size(ntfile)
| size[ntfile] | |
| Variants | size[ntfile] |
| Previously | ntfilesize |
| Group | Basic Attributes |
| Version | advcheck.dll > 1.6.4 |
Defines which size the scanned file must have.
Contents
Usage
size[ntfile]=<size(int)> size[ntfile]>=<size(int)> size[ntfile]<=<size(int)>
Examples
size[ntfile]=18373 size[ntfile]>=10000 size[ntfile]<=100000 size[ntfile]>=10000,ntfilesize<=100000
Description
Compares the size of the currently tested file against the specified size parameter. Next to a strict comparison, this one also allows lesser than or equal and greater than or equal checks. This is the version preferred for rootkits, since it uses native NT methods instead of the Win32 API, where files may be more likely to be hidden.
