I searched whole FTP trying to find the source…nothing. But then I did this.
1) Reset your CPanel/FTP password. It should come to e-mail u registered with your hosting provider. Give them a call if u forgot.
2) Login to CPanel and open PHPMyAdmin
3) Open your wordpress database (wrdp1 or whatever u named it), have a look atwp_posts table
4) Delete all instances of <script>…., it hides in post_title column on my site.
5) change your wp-admin pass in wp_users, user_pass field.
I suggest changing your database password to a very strong one, and backing up your SQL database as well, so next time all u have to do is import it back.