open a shell and run php from there (maybe a simple hello world) and see what comes out. if it outputs the injected code, you know what to fix.

open a shell and run php from there (maybe a simple hello world) and see what comes out. if it outputs the injected code, you know what to fix.

EDIT 1:
have not seen this before. i did some google queries on that before hand, the result is kinda small, but most of those results linked to pages where i got a security alert from avira: object <<< JS/Redirector.LC ; virus ; Contains detection pattern of the Java script virus JS/Redirector.LC