We have the exact same problem. Trouble is, it’s not in our header. I didn’t write the code to the website, and the guy who did no longer works here.
I’ve tried going through all our code searching for “Wonderful” or “Loader” and haven’t found anything. In case the same virus was placed on our site with a different name, anything else I might look for to identify it? Thanks in advance!