If you're using Seven as your admin theme (which is the out of the box default) then the script may have been added in a template file inside
I think the easy approach would be to pretend you're upgrading Drupal 7 and delete all the files and folders with the exception of the
After you "upgraded" your Drupal, if the problem still persists, then it means it may be somewhere in your
Go to /sites/all/themes/yourtheme/templates and Check all template files .tpl.php to see if any evil code was added to them.
Also, check your /sites/all/themes/template.php file to see if some evil code was added there, you should only see theme functions and regular Drupal code here.
Keep a lookout for any strange.php file names.
In addition, you can check if some module was added or altered using the Hacked! module.
If still no resolution, then most likely the script is in your Database. Due to you allowing FULL HTML or PHP in your text boxes or your DB was hacked.