Spam in list

[aldan]

this is the URL:
http://mtod.us/music/student-recita..._st_recital_app___recitalID_raw=38&Itemid=125

and this is what's happening:
[bimg=bcenter]http://mtod.us/spam.png[/bimg]

the code is clean:
<?php //echo $this->table->intro; // not using this here ?>
<p>The Student recitals in this section were recorded live,<br />with all the nervousness and excitement that these events bring?</p>
<form class="fabrikForm" action="<?php echo $this->table->action;?>" method="post" id="<?php echo $this->formid;?>" name="fabrikTable"><?php

where is this coming from? how can I get rid of it?

 

[troester]

Not sure what you mean.
But check your list access settings.
If add or edit records is public, everybody (who knows how to) can insert record into your list.

Edit:
now after seeing your png (the link is broken):
It seems your site has been hacked or you've installed a bad component or Joomla template ...
There are some strange named JS script files loading.
The text is inserted with different css classes with every page load (I hope it hasn't loaded some sort of virus on my PC ).

Which Joomla version are you running?
Disable all components, plugins; use standard beez or atomic template; check your installation...

 

[aldan]

hi troester, sorry the system didn't email me about your edit...
anyway, the spam came with some plugin called xcalendar, have no idea how the plugin installed itself. This guy got it too, so that makes me feel better...
http://forum.joomla.org/viewtopic.php?f=621&t=856452

I am running joomla 2.5.27, I was thinking of upgrading, but the site relies heavily on fabrik, including connection to my desktop FileMaker. I'm sure i'll break it when upgrading, and i don't have time to fix anything now.

if you have time, I would appreciate if you could check the javascripts, and let me know if you see something weird

anyway, while poking away through the files, I found some bad files in plugins/fabrik_element/googleometer/language/es-ES. See attached. Have no idea how they got there, but I found a bunch of recent references in the logs trying to POST to the files. I don't know if this is related with the other issue or not. If someone wants the php files, I still have them

thanks