hi, I encountered the same script on our site. I used grep -r 'czz8' /homedir/ to look for files containing the script. The QUERY.JS it calls...
Separate names with a comma.