Thread:Project:Support desk/Googlebot spam (cloaking?)

We are running MediaWiki	1.18.2 PHP	5.3.5 (cgi-fcgi) MySQL	5.1.53-log

Our site has been infected by some kind of malware such that pages retrieved by conventional browser user agents are perfectly normal, however pages retrieved by googlebot user agent contain spam. The result being that our Google search results have spurious spam titles and abstracts. Using Google webmaster tools I have seen the page 'as seen by Google' and it starts as follows:

HTTP/1.1 200 OK Date: Thu, 24 May 2012 23:53:55 GMT Server: Apache X-Content-Type-Options: nosniff Content-Encoding: gzip Vary: Accept-Encoding Content-length: 38024 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html

<!DOCTYPE html>  



Cheap Cialis No Prescription, Buy Cialis - Online Pill Shop, Safe And Secure.  

Where should I be looking to find the infection? I assume there is some code or configuration which allows user-agent-dependant meta tags or content to be generated.

Many thanks Rob

http://wiki.worldnakedbikeride.org/wiki/Southampton