Removing potentially malicious code from template
The script may be included from any of the files involved in the build and render pipeline of Drupal as it outputs a page so it's tough, as you say, to pinpoint the single file (it may also affect multiple files). It may also be stored in the database via something included on every page.

So, instead of spot cleaning it's recommended that you start fresh with known-to-be safe Drupal files by importing your database and custom code over a new Drupal install. Drupal provides documentation for handling a hacked site that details why this is a better strategy.

You may have been hacked via the SA-CORE-2014-005 Drupal core vulnerability but even if not this detailed rollback blog post may also help http://befused.com/drupal/drupalgeddon