WordPress.org

What does this look for specifically?

The scanner checks for all instances of timthumb it can find. It doesn't just check filename - it looks for code inside the file, ensuring that regardless of what a theme or plugin developer has named the file, it will be caught.

Where does it look for them?

The entire wp-content directory (even if it's not called wp-content) is scanned, including plugins, themes, and uploads.

I think I've already been hacked - will this clean it up?

No. This plugin exists to make sure your door is locked, not drag the burglers out of your house. It will run some cursory checks to see if a hacker has likely already hit your site, but has no functionality to clean up the problem.

If you've already been hacked, all is not lost - there are people out there who will clean up your site for a fee. Get in touch here: http://codegarage.com/hack-cleanup