Text is inserted into website if accessed from Google Search

[fgingras]

I am the administrator for a public k-12 school district using Joomla as our district website CMS. It has worked fine for years, but within the last 24 hours it has been reported to me that some users are seeing spam-like code inserted into our site. In trying to reproduce the error I have narrowed it down to the Google Search app for iPhone and Android and some Firefox users who use Google to search for the site and click on the district site from the search results.. If they enter the url of our site, or use other browsers, they will not see the text.

Google Search Terms: Hermitage School District
District URL: www.hermitage.k12.pa.us OR www.hickoryhornets.com

I have looked at our site articles in the backend interface and even in our database tables and I cannot see why or what is causing the text to appear.

We are currently using a Linux server (Ubuntu 4.04) and have applied all updates.

Any help would be appreciated.

Frank

[montano]

Look for files that have been modified or are new. It appears to be a base64 hack