scan all databases for hijack hack

hijack.php

#!/usr/bin/env php
<?php
    $email_addr = '[email protected]';
        $log_fpath = '/var/log/hijack.log';
    $user = 'admin';
    $pass = file_get_contents('/etc/psa/.psa.shadow');
    if ($pass === false)
        die("error fetching mysql password\n");
    $pass = trim($pass);
    $hostname = gethostname();
    $email_db_list = array();
    $db = new mysqli('localhost', $user, $pass);
    if (mysqli_connect_error()) {
        die("cannot connect to mysql server: " . mysqli_connect_error() . "\n");
    }
    $resdb = $db->query("SHOW databases");
    if (empty($resdb))
        die("cannot list databases");
    while ($r = $resdb->fetch_row()) {
        $dbname = $r[0];
        $resq = $db->query("SELECT * FROM {$dbname}.core_config_data WHERE value LIKE '%window.location%'");
        if (empty($resq))
            continue;
        $r = $resq->fetch_row();
        if (empty($r))
            continue;
        if ($r[0]*1 == 0)
            continue;
        $email_db_list[] = $dbname;
        $db->query("UPDATE {$dbname}.core_config_data SET value=NULL WHERE value LIKE '%window.location%'");



    }
    $db->close();
    if (!empty($email_db_list)) {
                $fh = fopen($log_fpath, 'ab+');
                if (!empty($fh)) {
                        fwrite($fh, "\n".date('d/m/Y H:i:s T')."\n");
                        fwrite($fh, implode("\n", $email_db_list));
                        fwrite($fh, "\n");
                        fclose($fh);
                }
        $ok = mail($email_addr, "List of db value=0 for {$hostname}", "Hostname: {$hostname}\n\n databases:\n" . implode("\n"
            , $email_db_list) . "\n");
        if (!$ok)
            die("Error sending email. List of databases: \n" . implode("\n", $email_db_list)."\n");
    }
?>