If you're using **Seven** as your admin theme (which is the out of the box default) then the script *may* have been added in a template file inside `/core/themes/seven` I think the easy approach would be to pretend you're upgrading Drupal 7 and delete all the files and folders with the exception of the `sites` folder. After you "upgraded" your Drupal, if the problem still persists, then it means it *may* be somewhere in your `sites` folder. Check all template files, and keep a lookout for any strange `.php` file. Also, check if some module was added or altered using the [Hacked!][1] module. If still no resolution, then most likely the script is in your Database. Due to you allowing FULL HTML on your text boxes or your DB was hacked. [1]: https://www.drupal.org/project/hacked