The antivirus plugin is probably picking up some bad coding in your template. Disable that template and revert back to the default one. Then run the antivirus plugin from the admin panel while the default theme is enabled. Most likely it won’t set off the bells and whistles again.
While you’re testing themes, install and run the TAC plugin, (theme authenticator). If the theme has any encrypted codes it should pick it up. A great plugin, in my opinion.
From what I understand, the timthumb.php file enables text to be hidden within an image, so it could be encrypted code within an image in the theme. I had downloaded a theme that also had a timthumb.php file, and discovered it added an image into my uploads folder. Didn’t feel comfortable with the timthumb thing so I deleted that theme.