Had this been the case, people would have had been sending out PHP to administrators 🙂 It would have been the most deadly virus ever 😉
After that quick joke, see carefully your server logs, all of them inclusing error logs, if it was to happen due to php, error should be there in error log plus, just scan your system, might be that you have a trojan etc. with php.exe somewhere and it is found before the actual php.exe could be found in the path, check out the windows directory first.