Hacked and how to find

I think I’ve been hacked. I’m not much of a coder, be warned. There is a script running just before the header of every page on several sites on the same server. It’s redirecting to another server/site in another country and then eventually loading the page. It’s slowing everything down significantly. You can see it by visiting https://www.telestorypictures.com/h2m or any other page for that matter on that site. Of course it’s in some other websites I host.

Question – where could this initiate from, can I extract it from each page, and/or is there a root to this beast where I can rip it out forever and stop it?

Thanks,