If you're using **Seven** as your admin theme (which is the out of the box default) then the script *may* have been added in a template file inside `/core/themes/seven`

I think the easy approach would be to pretend you're upgrading Drupal 7 and delete all the files and folders with the exception of the `sites` folder.

After you "upgraded" your Drupal, if the problem still persists, then it means it *may* be somewhere in your `sites` folder.

Go to /sites/all/themes/yourtheme/templates and Check all template files **.tpl.php** to see if any evil code was added to them.

Also, check your /sites/all/themes/**template.php** file to see if some evil code was added there, you should only see theme functions and regular Drupal code here. 

Keep a lookout for any strange.php file names. 

In addition, you can check if some module was added or altered using the [Hacked!][1] module.

If still no resolution, then most likely the script is in your Database. Due to you allowing FULL HTML or PHP in your text boxes or your DB was hacked. 


  [1]: https://www.drupal.org/project/hacked