Help my sites been hacked

Hi,
I just checked my site to find its been hacked in last 2 days.
I cant find where to remove this code they have added to the header. I need to fix before I get blacklisted from goggle.
my website is https://www.babysocial.com.au

I read all the resources:

Some information on getting started with site cleanup:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/
https://codex.www.ads-software.com/Hardening_WordPress

Additional Resources:
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

but cant find a way to remove this. I have edited my theme and wordpress file so much I’m concerned I will lose so much if I upgrade my wordpress currently on 3.5 version.

This is the code
html += ‘</div>’ + ‘<script language=”JavaScript”>var _ga2 = []; _ga2.push([‘_setOption’, [code moderated]

Thanks for your help in advance