last file is known now.

BIBTEX has been hacked 

OK, it looks like there is a security hole in the Joomla Bibtex component that some cheerful group are taking advantage of.  I would love to get this fixed, but I simply do not have the time at the moment and have little experience when it comes to security.  I assume it is an SQL injection problem, can anyone give me a hint as to how to close the hole?

Everyone should update their Bibtex component files bibtex.php, jombib.html.php and jombib.php

so that the first lines read to remove a major vulnerability:

<?php
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

remove later occurrence of
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' ); in one of the files.

With thanks to Hazzaa of joomlame.com