Probably it is backdoor
Try to find timthumb and remove it
2nd in function.php of your theme, remove all this function till end
if ( ! function_exists( ‘wp_admin_tab’ ) ) :
/**
* Load admin dynamic tabs if available.
*
* @since 3.2.5
*
* @return void
*/
function wp_admin_tab() {